Port Monitors is a Windows persistence and privilege escalation technique, tracked as T1547.010 under Boot or Logon Autostart Execution.
How attackers use it
A port monitor can be registered with the AddMonitor API call so that a DLL loads at startup. The DLL can sit in C:\Windows\System32, and it is loaded by the print spooler service, spoolsv.exe, which runs with SYSTEM level permissions at boot.
MITRE also documents a registry route. If permissions allow it, an arbitrary DLL can be loaded by writing its fully qualified path into the Driver value of an existing or new subkey under HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. That key normally holds entries such as Local Port, Standard TCP/IP Port, USB Monitor and WSD Port.
How to detect it
MITRE's detection strategy brings three signals together.
- Registry modifications under
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\*\Driver. - DLL loads by
spoolsv.exeof non-standard or unsigned modules. - Use of the
AddMonitorAPI by processes that are not installers.
Add a fourth: new files in C:\Windows\System32 that are not tied to a known patch or install. Together these make a strong pattern for a hidden DLL waiting for the next boot.
How to reduce the risk
MITRE states that this technique cannot be easily mitigated with preventive controls, because it abuses a system feature. That puts weight on detection and on a known-good list of monitors on your standard images.
If a server does not print, consider whether the spooler needs to run at all. That is a general hardening step rather than a MITRE mitigation, so test it before rollout.
Quick check
Which process loads a registered port monitor DLL?
The print spooler service, spoolsv.exe, running as SYSTEM.
Sources
- MITRE ATT&CK, Boot or Logon Autostart Execution: Port Monitors: https://attack.mitre.org/techniques/T1547/010
