LoFP / domain controllers acting as printer servers too? :)

Techniques

• t1021
• t1021.002

Sample rules

DCERPC SMB Spoolss Named Pipe

• source: sigma
• technicques:
  • t1021
  • t1021.002

Description

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Detection logic

condition: selection
selection:
  EventID: 5145
  RelativeTargetName: spoolss
  ShareName: \\\\\*\\IPC$