Hide Navigation Hide TOC Suspicious Spool Service Child Process (dcdbc940-0bff-46b2-95f3-2d73f848e33b) Detects suspicious print spool service (spoolsv.exe) child processes. Cluster A Galaxy A Cluster B Galaxy B Level Exploitation for Privilege Escalation - T1068 (b21c3b2d-02e6-45b1-980b-e69051040839) Attack Pattern Suspicious Spool Service Child Process (dcdbc940-0bff-46b2-95f3-2d73f848e33b) Sigma-Rules 1 Suspicious Spool Service Child Process (dcdbc940-0bff-46b2-95f3-2d73f848e33b) Sigma-Rules Exploitation for Client Execution - T1203 (be2dcee9-a7a7-4e38-afd6-21b31ecc3d63) Attack Pattern 1