Techniques › T1547.012 › AN0074
AN0074 Analytic 0074
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Correlated registry modifications under Print Processors path, followed by DLL file creation within the system print processor directory, and DLL load by spoolsv.exe. Malicious execution often occurs during service restart or system boot, with SYSTEM-level privileges.</p>
- Detects
- T1547.012 Print Processors
- Part of
- DET0026 Windows Detection Strategy for T1547.012 - Print Processor DLL Persistence
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=13, 14 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlate Registry + DLL Write + Module Load within a short boot or spooler restart window (e.g., 5 minutes). |
PrintProcessorDirectory | System-specific path derived from GetPrintProcessorDirectory API call; may differ across Windows versions or configurations. |
DLLNamePattern | Some environments may use custom or non-standard DLL naming conventions for print processors. Allowlist known values. |
SignedImageValidation | Check Authenticode signature and issuer chain for loaded DLLs to reduce false positives. |
ServiceRestartTrigger | Monitor for spoolsv.exe restart events that trigger malicious print processor loading. |