tfMITRE ATT&CK sub-technique

Port Monitors T1547.010

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.3
Created: 24 January 2020
Last modified: 24 October 2025
Contributors: Stefan Kanthak; Travis Smith, Tripwire; Harun Küßner

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.[1] This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, spoolsv.exe, under SYSTEM level permissions on boot.[2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Offense vs defense T1547.010

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1

first rule: 2020 Q2

Port Monitors detection strategy DET0204

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1547.010 – Port Monitor DLL Persistence via spoolsv.exe (Windows)

Enterprise

1 platform

AN0580 · Windows

Detects suspicious registry modifications under HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\*\Driver, DLL loads by spoolsv.exe of non-standard or unsigned modules, and abnormal usage of the AddMonitor API by non-installation processes. This pattern often indicates an attempt to persist a malicious DLL via the print monitor mechanism, particularly when correlated with creation of files in C:\Windows\System32 not tied to known patches or installations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
OS API ExecutionDC0021	WinEventLog:Application	API call to AddMonitor invoked by non-installer process
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetDLLDirectory	Expected directory path for legitimate monitor DLLs (e.g., C:\Windows\System32)
SignedImageValidation	Enable/disable signature validation on DLLs loaded by spoolsv.exe
UserContextScope	Define whether only SYSTEM/user installs are expected to make changes to the port monitor registry keys
TimeWindow	Timeframe between registry modification and subsequent spoolsv.exe DLL load
AddMonitorCallContext	Filter on calling process of AddMonitor API to detect anomalies outside installer/updater

1 analytic

The Sysinternals tool Autoruns checks the registry and file system for known identify persistence mechanisms. It will output any tools identified, including built-in or added-on Microsoft functionality and third party software. Many of these locations are known by adversaries and used to obtain Persistence. Running Autoruns periodically in an environment makes it possible to collect and monitor its output for differences, which may include the removal or addition of persistent tools. Depending on the persistence mechanism and location, legitimate software may be more likely to make changes than an adversary tool. Thus, this analytic may result in significant noise in a highly dynamic environment. While Autoruns is a convenient method to scan for programs using persistence mechanisms its scanning nature does not conform well to streaming based analytics. This analytic could be replaced with one that draws from sensors that collect registry and file information if streaming analytics are desired.

TypesSituational Awareness, TTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-SICA	System Init Config Analysis

Tests1Executorscmd 1Need elevation1 of 1Have prerequisites0Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Add Port Monitor persistence in Registry

windows

cmd

Required

—

Yes

Add key-value pair to a Windows Port Monitor registry. On the subsequent reboot DLL will be execute under spoolsv with NT AUTHORITY/SYSTEM privilege.

Input arguments

Name	Type	Default	Description
monitor_dll	path	$PathToAtomicsFolder\T1547.010\bin\PortMonitor.dll	Addition to port monitor registry key. Normally refers to a DLL name in C:\Windows\System32 but an arbitrary DLL can be specified with the absolute path.

Attack command

reg add "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /v "Driver" /d "#{monitor_dll}" /t REG_SZ /f

Cleanup command

reg delete "hklm\system\currentcontrolset\control\print\monitors\AtomicRedTeam" /f >nul 2>&1

GUID6c4df8c4-6e1b-4d3d-a28e-a071a8e079ff

Tests from Atomic Red Team (MIT licence) · technique definition

Port Monitors detections T1547.010

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs