SMB Spoolss Name Piped Usage

Status: test
Severity: medium
Log source: product zeek, service smb_files
Author: OTR (Open Threat Research), @neu5ron
Source: github.com/SigmaHQ/sigma

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Known false positives

Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Rule body

title: SMB Spoolss Name Piped Usage
id: bae2865c-5565-470d-b505-9496c87d0c30
status: test
description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
references:
    - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
    - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
    - https://twitter.com/_dirkjan/status/1309214379003588608
author: OTR (Open Threat Research), @neu5ron
date: 2018-11-28
modified: 2022-10-09
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: zeek
    service: smb_files
detection:
    selection:
        path|endswith: 'IPC$'
        name: spoolss
    condition: selection
falsepositives:
    - Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    path|endswith: 'IPC$'
    name: spoolss

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`name`	eq	`spoolss`	`field:"name" kind:eq value:"spoolss"`
`path`	ends_with	`IPC$`	`field:"path" kind:ends_with value:"IPC$"`