Port Monitor DLL Registered via Print Spooler

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects network traffic on port 445 (SMB) where the content of the traffic contains both "Monitors" and "spoolsv" (case-insensitive). This combination of keywords suggests an attempt to register a port monitor DLL via the Print Spooler service, which is a known technique for persistence and privilege escalation.