← Back to SOC feed Coverage →

Suspicious files in spool folder

kql MEDIUM Azure-Sentinel
DeviceFileEvents
exploithuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-21T23:00:01Z · Confidence: medium

Hunt Hypothesis

Adversaries may leverage the spool folder to stage malicious files as part of a privilege escalation or persistence tactic. SOC teams should proactively hunt for this behavior to identify potential exploitation of known vulnerable drivers and prevent lateral movement in their Azure Sentinel environment.

KQL Query

DeviceFileEvents
| where FolderPath has @"System32\spool\drivers"
| project DeviceName,Timestamp,ActionType,FolderPath,FileName,SHA1

Analytic Rule Definition

id: 664afd0d-c979-4970-affe-fc17f01276fb
name: Suspicious files in spool folder
description: |
  Monitor for creation of suspicious files in the /spools/driver/ folder. This is a broad-based search that will surface any creation or modification of files in the folder targeted by this exploit. False Positives for legitimate driver activity (when that activity should be present) in this folder are possible
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Privilege escalation
- Exploit
query: |
  DeviceFileEvents
  | where FolderPath has @"System32\spool\drivers"
  | project DeviceName,Timestamp,ActionType,FolderPath,FileName,SHA1

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Exploits/Print Spooler RCE/Suspicious files in spool folder.yaml