CVE-2022-41073

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "spoolsv.exe"
| where InitiatingProcessFileName =~ "spoolsv.exe" or InitiatingProcessParentFileName =~ "spoolsv.exe"
| where ProcessCommandLine has_any ("powershell", "cmd.exe", "wmic", "net.exe", "sc.exe") or ProcessCommandLine has_any ("/c", "/k", "-exec", "-command")
| where not (ProcessCommandLine has_any ("print", "printer", "driver", "install")) // Filter out legitimate print-related commands
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessIntegrityLevel, ProcessIntegrityLevel

Splunk SPL

index=windows_events (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="WinEventLog:Security")
| where (EventCode=1 OR EventCode=4688) AND (ParentProcessName="spoolsv.exe" OR ProcessName="spoolsv.exe")
| where CommandLine LIKE "%powershell%" OR CommandLine LIKE "%cmd.exe%" OR CommandLine LIKE "%wmic%" OR CommandLine LIKE "%net.exe%" OR CommandLine LIKE "%sc.exe%"
| where NOT (CommandLine LIKE "%print%" OR CommandLine LIKE "%printer%" OR CommandLine LIKE "%driver%" OR CommandLine LIKE "%install%")
| table _time, Hostname, ParentProcessName, ProcessName, CommandLine, User

Sigma

title: Windows Print Spooler EoP Anomaly
author: SecBoard Operations
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\spoolsv.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wmic.exe'
      - '\net.exe'
      - '\sc.exe'
  filter:
    CommandLine|contains:
      - 'print'
      - 'printer'
      - 'driver'
      - 'install'
  condition: selection and not filter
fields:
  - CommandLine
  - ParentCommandLine
  - User
  - Image
  - ParentImage
level: high

Elastic ES|QL

from process where event.type == "start" and 
  (process.parent.executable : "spoolsv.exe" or process.executable : "spoolsv.exe") and 
  (process.args : "powershell" or process.args : "cmd.exe" or process.args : "wmic" or process.args : "net.exe" or process.args : "sc.exe") and 
  not (process.args : "print" or process.args : "printer" or process.args : "driver" or process.args : "install")
| select @timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line, user.name, process.integrity.level