{"id":"T1547.010","name":"Port Monitors","url":"https://attack.mitre.org/techniques/T1547/010","tactics":["persistence","privilege-escalation"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0204","stix_id":"x-mitre-detection-strategy--a62dbd10-5b61-489c-a465-8f792792778e","name":"Detection Strategy for T1547.010 – Port Monitor DLL Persistence via spoolsv.exe (Windows)","url":"https://attack.mitre.org/detectionstrategies/DET0204","analytics":[{"id":"AN0580","stix_id":"x-mitre-analytic--61729716-59f3-433e-a678-101c18040851","name":"Analytic 0580","description":"Detects suspicious registry modifications under `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors\\*\\Driver`, DLL loads by `spoolsv.exe` of non-standard or unsigned modules, and abnormal usage of the `AddMonitor` API by non-installation processes. This pattern often indicates an attempt to persist a malicious DLL via the print monitor mechanism, particularly when correlated with creation of files in `C:\\Windows\\System32` not tied to known patches or installations.","url":"https://attack.mitre.org/detectionstrategies/DET0204#AN0580","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Application","channel":"API call to AddMonitor invoked by non-installer process","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"wineventlog-application"}],"mutable_elements":[{"field":"TargetDLLDirectory","description":"Expected directory path for legitimate monitor DLLs (e.g., C:\\Windows\\System32)"},{"field":"SignedImageValidation","description":"Enable/disable signature validation on DLLs loaded by spoolsv.exe"},{"field":"UserContextScope","description":"Define whether only SYSTEM/user installs are expected to make changes to the port monitor registry keys"},{"field":"TimeWindow","description":"Timeframe between registry modification and subsequent spoolsv.exe DLL load"},{"field":"AddMonitorCallContext","description":"Filter on calling process of AddMonitor API to detect anomalies outside installer/updater"}],"live":true,"detection_strategies":["DET0204"],"techniques":["T1547.010"]}],"live":true,"version":"1.0","techniques":["T1547.010"]}],"sigma_rules":[{"id":"509e84b9-a71a-40e0-834f-05470369bd1e","title":"Default RDP Port Changed to Non Standard Port","author":"frack113","status":"test","level":"high","date":"2022-01-01","modified":"2024-03-25","description":"Detects changes to the default RDP port.\nRemote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.\nMicrosoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.010"],"path":"rules/windows/registry/registry_set/registry_set_change_rdp_port.yml","techniques":["T1547.010"],"cves":[]},{"id":"674202d0-b22a-4af4-ae5f-2eda1f3da1af","title":"Bypass UAC Using Event Viewer","author":"frack113","status":"test","level":"high","date":"2022-01-05","modified":"2023-08-17","description":"Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification","references":["https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.010"],"path":"rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml","techniques":["T1547.010"],"cves":[]},{"id":"944e8941-f6f6-4ee8-ac05-1c224e923c0e","title":"Add Port Monitor Persistence in Registry","author":"frack113","status":"test","level":"medium","date":"2021-12-30","modified":"2024-03-25","description":"Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.\nA port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.t1547.010"],"path":"rules/windows/registry/registry_set/registry_set_add_port_monitor.yml","techniques":["T1547.010"],"cves":[]},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","author":"Janantha Marasinghe","status":"test","level":"medium","date":"2022-11-18","modified":"2022-12-30","description":"Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy","references":["https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.discovery","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.execution","attack.stealth","attack.defense-impairment","attack.t1685.001","attack.t1547.001","attack.t1505.005","attack.t1556.002","attack.t1685","attack.t1574.007","attack.t1564.002","attack.t1546.008","attack.t1546.007","attack.t1547.014","attack.t1547.010","attack.t1547.002","attack.t1557","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_secedit_execution.yml","techniques":["T1685.001","T1547.001","T1505.005","T1556.002","T1685","T1574.007","T1564.002","T1546.008","T1546.007","T1547.014","T1547.010","T1547.002","T1557","T1082"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}