PrintSpoofer download and execution attempt for SYSTEM privilege escalation
Detects the execution of PrintSpoofer or its derivatives, often used to perform privilege escalation on Windows systems by abusing the Print Spooler service. The rule also covers the download of the tool via PowerShell.
Microsoft Sentinel (KQL)
