T1547.010 — Port Monitors

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This DLL can be located in C:\Windows\System32 and will be loaded and run…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.010 Boot or Logon Autostart Execution: Port Monitors

title: "T1547.010 Boot or Logon Autostart Execution: Port Monitors"
id: ffe2e90e-506c-465a-9246-efb5b6bd3cef
description: 'Detection Strategy for T1547.010 - Port Monitor DLL Persistence via spoolsv.exe, retargeted to the actual AddMonitor artifacts: a registry Driver value written under Control\Print\Monitors, or an anomalous non-system DLL loaded into spoolsv.exe. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: TargetDLLDirectory, SignedImageValidation, UserContextScope, TimeWindow, AddMonitorCallContext.'
references:
  - https://attack.mitre.org/techniques/T1547/010
author: Shahrukh Khan
date: 2026-02-05
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.010

logsource:
  product: windows
  service: sysmon

detection:
  selection_registry:
    EventID: '13'
    TargetObject|contains: 'CurrentControlSet\Control\Print\Monitors\'
    TargetObject|endswith: '\Driver'
  selection_imageload:
    EventID: '7'
    Image|endswith: '\spoolsv.exe'
    ImageLoaded|contains:
      - '\Users\'
      - '\Temp\'
      - '\ProgramData\'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_registry or selection_imageload) and not filter_system_account

falsepositives:
  - Legitimate printer driver/port-monitor installation.

level: medium

Related sub-techniques

Explore