Hide Navigation Hide TOC

Suspicious NTLM Authentication on the Printer Spooler Service (bb76d96b-821c-47cf-944b-7ce377864492)

Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Suspicious NTLM Authentication on the Printer Spooler Service (bb76d96b-821c-47cf-944b-7ce377864492)	Sigma-Rules	Exploitation for Credential Access - T1212 (9c306d8d-cde7-4b4c-b6e8-d0bb16caca36)	Attack Pattern	1