Applied Cybernetics Group
T1547.010 Port Monitors
- Technique
T1547.010- Tactics
- Persistence, Privilege Escalation
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 4
- Elastic, Splunk
- 2
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1547/010
MITRE description
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the <code>AddMonitor</code> API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in <code>C:\Windows\System32</code> and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the `Driver` value of an existing or new arbitrarily named subkey of <code>HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</code>. The Registry key contains entries for the following: * Local Port * Standard TCP/IP Port * USB Monitor * WSD Port
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-08-13Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them
Detection coverage
SigmaHQ community rules
- Potential Suspicious Activity Using SeCEdit (core)
- Add Port Monitor Persistence in Registry (core)
- Bypass UAC Using Event Viewer (core)
- Default RDP Port Changed to Non Standard Port (core)