Suspicious Parent Process for spoolsv.exe (Windows Event Log)

id: '16165.24269'
title: Suspicious Parent Process for spoolsv.exe
description: This use case detects when the Windows print spooler process (spoolsv.exe)
  is executed as a child from an unexpected parent process. This can indicate process
  injection/hollowing, masquerading, or other suspicious activity. The expected parent
  process for spoolsv.exe is services.exe.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) "spoolsv.exe" | regex process_path="(?i)\x5csystem32\x5cspoolsv\.exe"|
  regex parent_process_name!="(?i)services\.exe|\%14\!S\!"| where isnotnull(parent_process_name)
  and not match(parent_process_name, "^-$") | table _time, host, user process, process_*,
  parent_process_name, parent_process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- defense-evasion:masquerading:masquerade task or service
- defense-evasion:process injection
technique_id:
- T1036.004
- T1055
data_category:
- Windows event logs
references:
- https://andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/