Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the
AddMonitor API call to set a DLL to be loaded at startup.[1] This DLL can be
located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level
permissions.[2] Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.
The Registry key contains entries for the following:
Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0022 | File | File Creation |
Monitor newly constructed files that may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. |
| DS0011 | Module | Module Load |
Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal. New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious. |
| DS0009 | Process | OS API Execution |
Monitor process API calls to |
| DS0024 | Windows Registry | Windows Registry Key Modification |
Monitor Registry writes to |