Sigma Rules

Suspicious Spool Service Child Process

Detects suspicious print spool service (spoolsv.exe) child processes.