Print processor DLL registered under the spooler Environments key

Siemphony@siemphonymediumT1547.012unverifiedPlaybook · Persistence established

Matches a registry value write inside the print spooler's Print Processors subtree, whose full shape is `...\Control\Print\Environments\<architecture>\Print Processors\<name>\Driver`: the adversary-chosen `<name>` is a subkey and `Driver` is the value name holding the DLL that spoolsv.exe loads at boot, so a Sysmon EventID 13 record ends at the value and an `endswith` stopping at `\Print Processors` would never fire. The match is split into two `contains` terms rather than one anchored path because the architecture element varies (`Windows x64`, `Windows NT x86`, `Windows ARM64`) and the control set is either `CurrentControlSet` or `ControlSet001`; the hive prefix is left out for the same reason. Writes whose data is the built-in `winprint.dll` are dropped, which is MITRE's `DLLNamePattern` knob populated here with the one processor every Windows install already has — the exclusion is authored, not sourced. The rest of AN0074 — the payload appearing in the system print-processor directory and then loading into spoolsv.exe on the next spooler restart — is a correlation across three event types inside MITRE's `TimeWindow` knob and is not expressible in Sigma; note also that Sysmon logs registry activity only for paths its configuration allowlists, so confirm this key is included before reading silence as a clean result. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0026, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Print processor DLL registered under the spooler Environments key2id: 4ceaf062-7bfb-4ad7-be48-303dfe6d6fd53status: experimental4description: |5  Matches a registry value write inside the print spooler's Print Processors6  subtree, whose full shape is7  `...\Control\Print\Environments\<architecture>\Print Processors\<name>\Driver`:8  the adversary-chosen `<name>` is a subkey and `Driver` is the value name holding9  the DLL that spoolsv.exe loads at boot, so a Sysmon EventID 13 record ends at10  the value and an `endswith` stopping at `\Print Processors` would never fire. The match is split into two `contains`11  terms rather than one anchored path because the architecture element varies12  (`Windows x64`, `Windows NT x86`, `Windows ARM64`) and the control set is13  either `CurrentControlSet` or `ControlSet001`; the hive prefix is left out for14  the same reason. Writes whose data is the built-in `winprint.dll` are dropped,15  which is MITRE's `DLLNamePattern` knob populated here with the one processor16  every Windows install already has — the exclusion is authored, not sourced.17  The rest of AN0074 — the payload appearing in the system print-processor18  directory and then loading into spoolsv.exe on the next spooler restart — is a19  correlation across three event types inside MITRE's `TimeWindow` knob and is20  not expressible in Sigma; note also that Sysmon logs registry activity only for21  paths its configuration allowlists, so confirm this key is included before22  reading silence as a clean result.23  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0026, not hand-written and not tested by its author. Any lab result is on this rule's own page.24references:25  - https://attack.mitre.org/techniques/T1547/01226  - https://attack.mitre.org/detectionstrategies/DET002627author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1629tags:30  - attack.persistence31  - attack.privilege-escalation32  - attack.t1547.01233logsource:34  category: registry_set35  product: windows36detection:37  selection_environments:38    TargetObject|contains: '\Control\Print\Environments\'39  selection_processor:40    TargetObject|contains: '\Print Processors\'41  filter_builtin:42    Details|endswith: 'winprint.dll'43  condition: selection_environments and selection_processor and not filter_builtin44falsepositives:45  - "Printer driver packages from print-device vendors, which register their own print processor and write its DLL name to the Driver value during installation. This is the highest-volume match by a wide margin in any estate with managed printers, and it repeats on every driver update and on every newly imaged host."46  - "Virtual and software printers — PDF writers, label and receipt printers, VDI and remote-desktop print redirection — that install a custom print processor as a supported feature of the product."47  - "Print server role configuration and driver replication between servers, where the spooler rebuilds the Environments subtree for each architecture it serves and rewrites the Driver value for processors that are already present."48  - "Golden image builds and OS servicing runs that provision the print subsystem; the winprint exclusion removes the built-in processor but not the third-party ones baked into a corporate image."49level: medium

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where ((RegistryKey contains "\\Control\\Print\\Environments\\" and RegistryKey contains "\\Print Processors\\") and not (RegistryValueData endswith "winprint.dll"))

Splunk · SPL

Run this as a search.

index=* ((TargetObject="*\\Control\\Print\\Environments\\*" AND TargetObject="*\\Print Processors\\*") AND NOT (Details="*winprint.dll"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(registry.path) LIKE "*\\\\control\\\\print\\\\environments\\\\*" AND TO_LOWER(registry.path) LIKE "*\\\\print processors\\\\*") AND NOT (TO_LOWER(registry.data.strings) LIKE "*winprint.dll"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\Control\\Print\\Environments\\</field>    <field name="TargetObject" type="pcre2">(?i)\\Print Processors\\</field>    <field name="Details" negate="yes" type="pcre2">(?i)winprint\.dll$</field>    <description>Print processor DLL registered under the spooler Environments key</description>    <mitre>      <id>T1547.012</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4ceaf062-7bfb-4ad7-be48-303dfe6d6fd5

ATT&CKT1547.012

T1547.012Print Processors

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Not verified

Security Datasets — Print processor persistence (PrintNightmare)
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.012, evaluated against their registry_set events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add a third ANDed term, TargetObject|endswith: '\Driver', to stop matching
Treat filter_builtin as noise suppression, not a trust boundary — don't
The file-creation and module-load stages of AN0074 need file_event and

Declared by the author

Printer driver packages from print-device vendors, which register their own print processor and write its DLL name to the Driver value during installation. This is the highest-volume match by a wide margin in any estate with managed printers, and it repeats on every driver update and on every newly imaged host.
Virtual and software printers — PDF writers, label and receipt printers, VDI and remote-desktop print redirection — that install a custom print processor as a supported feature of the product.
Print server role configuration and driver replication between servers, where the spooler rebuilds the Environments subtree for each architecture it serves and rewrites the Driver value for processors that are already present.
Golden image builds and OS servicing runs that provision the print subsystem; the winprint exclusion removes the built-in processor but not the third-party ones baked into a corporate image.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN0074 describes a three-stage chain: a registry write under the spooler's Print Processors key, a DLL dropped in the system print-processor directory, and that DLL loading into spoolsv.exe on the next restart. This rule covers only the first stage — a single Sysmon EventID 13 registry-value write. It is a precursor signal: a hit means someone registered a print processor, not that a malicious DLL has loaded.

02 · Telemetry you need

Sysmon EventID 13, as category: registry_set / product: windows, copied verbatim from AN0074. Sysmon's registry logging is allowlist-driven by its own config — if the Print Processors subtree isn't in that allowlist, this rule returns nothing, and that silence means "not collected," not "clean." Sentinel has no table modelled for this logsource and refuses the rule outright; three of four backends render it.

03 · How the logic works

Two contains terms, ANDed: TargetObject|contains: '\Control\Print\Environments\' and TargetObject|contains: '\Print Processors\', then a not filter. contains instead of endswith matters here. The real key shape is ...\Environments\<architecture>\Print Processors\<adversary-chosen name>\Driver — the value name Driver sits after the attacker's own subkey, so an endswith anchored at \Print Processors would never fire; the path keeps going. Splitting the environments and processor checks into two separate contains terms, instead of one long anchored string, absorbs two more variables Sigma can't wildcard cleanly: the architecture element (Windows x64, Windows NT x86, Windows ARM64) and the control set (CurrentControlSet or ControlSet001). The hive prefix is dropped for the same reason. filter_builtin excludes writes where Details|endswith: 'winprint.dll' — MITRE's DLLNamePattern knob, populated here with the one print processor every Windows install already ships. That exclusion is the author's choice, not MITRE's; MITRE names the knob, not the value.

04 · Common false positives

Heavily, and mostly from legitimate driver management. The top false positive is printer driver installation itself: vendor driver packages register their own print processor and write to the Driver value on every install, every driver update, and every freshly imaged host — this is described as the highest-volume match by a wide margin, which is why the rule sits at level: medium rather than high. Behind it: virtual/software printers (PDF writers, VDI print redirection), print-server role configuration replicating the Environments subtree across servers, and golden-image builds that bake in third-party processors the winprint.dll exclusion never touches.
The review caught two sharper problems worth learning from. First, the filter_builtin exclusion checks only a literal filename with no path or signer check — an attacker who names a malicious payload winprint.dll is silently waved through by the rule's own noise filter. A filename-only exclusion is not a security boundary; it's exactly as trustworthy as the string an attacker can trivially copy. Second, the selection never anchors on \Driver itself, so it also matches any other value written under that same adversary subkey — an Attributes or Help File entry, say — which is wider than the analytic strictly needs.

05 · Detection maturity

tier_1: .** Derived from a MITRE scaffold with no query logic behind it, and never run against a log line. The evasion above — naming a payload winprint.dll — was found by static review, not by testing; it says nothing about real-world hit volume, which is unknown until this runs read-only against actual driver-install activity.

Related detections2 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/4ceaf062-7bfb-4ad7-be48-303dfe6d6fd5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Print processor DLL registered under the spooler Environments key

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it