Print Spooler Spawning SVCHOST Process
Detects the Print Spooler service (spoolsv.exe) spawning svchost.exe. This behavior is leveraged by the WIN_PLUS variant of SprySOCKS to execute a first-stage print processor loader, which then injects the backdoor into a newly created svchost.exe process.
Microsoft Sentinel (KQL)
