T1547.012 — Print Processors

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot. Adversaries may abuse the print spooler service by adding print…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.012 Boot or Logon Autostart Execution: Print Processors

title: "T1547.012 Boot or Logon Autostart Execution: Print Processors"
id: c1fa2785-3a67-42b1-8e78-816b657e55e4
description: 'Windows Detection Strategy for T1547.012 - Print Processor DLL Persistence, retargeted to the actual AddPrintProcessor artifacts. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: TimeWindow, PrintProcessorDirectory, DLLNamePattern, SignedImageValidation, ServiceRestartTrigger.'
references:
  - https://attack.mitre.org/techniques/T1547/012
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.012

logsource:
  product: windows
  service: sysmon

detection:
  selection_registry:
    EventID: '13'
    TargetObject|contains|all:
      - '\Control\Print\Environments\'
      - 'Print Processors\'
    TargetObject|endswith: '\Driver'
  selection_imageload:
    EventID: '7'
    Image|endswith: '\spoolsv.exe'
    ImageLoaded|contains: '\spool\prtprocs\'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_registry or selection_imageload) and not filter_system_account

falsepositives:
  - Legitimate print processor installation during driver package deployment.

level: medium

Related sub-techniques

Explore