cyberstrikeus T1547.010 Port Monitors
Sub-technique of: T1547
High-Level Description
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, spoolsv.exe, under SYSTEM level permissions on boot.
Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the Driver value of an existing or new arbitrarily named subkey of HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. The Registry key contains entries for the following:
- Local Port
- Standard TCP/IP Port
- USB Monitor
- WSD Port
Kill Chain Phase
- Persistence (TA0003)
- Privilege Escalation (TA0004)
Platforms: Windows
What to Check
- Identify if Port Monitors technique is applicable to target environment
- Check Windows systems for indicators of Port Monitors
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Add Port Monitor persistence in Registry
Add key-value pair to a Windows Port Monitor registry. On the subsequent reboot DLL will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.
Supported Platforms: windows Elevation Required: Yes
reg add "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /v "Driver" /d "#{monitor_dll}" /t REG_SZ /f
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Port Monitors by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1547.010 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
No specific mitigations documented for this technique.
Detection
Detection Strategy for T1547.010 – Port Monitor DLL Persistence via spoolsv.exe (Windows)
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Port Monitors technique applicable | High | Persistence |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-276 | Incorrect Default Permissions |