Print processors are DLLs loaded by the print spooler service, spoolsv.exe, during boot. MITRE tracks their abuse as T1547.012, with the tactics Persistence and Privilege Escalation on Windows.
How attackers use it
An adversary can add a print processor that loads a malicious DLL at startup. MITRE describes two ways in. A processor can be installed through the AddPrintProcessor API call by an account that has SeLoadDriverPrivilege enabled. Or it can be registered by adding a Driver value under the Print Processors key for the system architecture, found under HKLM\SYSTEM\[CurrentControlSet or ControlSet001]\Control\Print\Environments.
The payload has to sit in the dedicated print processor directory, which the GetPrintProcessorDirectory API call returns, or be referenced by a relative path from it. The spooler must then restart for the processor to run.
Because the spooler runs as SYSTEM, the processor does too.
How to detect it
MITRE's detection strategy correlates three events:
- Registry changes under the Print Processors path.
- A DLL file created in the system print processor directory.
- A DLL load by
spoolsv.exe.
Execution typically happens at a service restart or at boot, so watch those windows.
How to reduce the risk
MITRE's mitigation is User Account Management: limit the accounts that can load or unload device drivers by disabling SeLoadDriverPrivilege for everyone who does not need it. Review who holds that right in your policy, since it is the gate for the API route.
Quick check
Which privilege does the AddPrintProcessor route require?
SeLoadDriverPrivilege must be enabled for the account calling the API.
Sources
- MITRE ATT&CK, Boot or Logon Autostart Execution: Print Processors: https://attack.mitre.org/techniques/T1547/012
