spoolsv
Print Spooler
The print spooler's API server, a service that starts with Windows.
- Normal Processes
- Session 0
- Open it in the tree
Normal Profile
These are the values a genuine copy shows. Treat any value that differs as a lead.
- Parent
- services.exe (a value that published detection rules check for)Source: Elastic: Unusual Parent-Child Relationship (opens in a new tab)
- Path
- System32 (a value that published detection rules check for)
C:\Source: SigmaHQ: System File Execution Location Anomaly (opens in a new tab)Windows\ System32\ spoolsv.exe - Account
- Read the Spooler service's configured account, its ObjectName in the Services key, and the token with Get-Process -IncludeUserName.
- Session
- 0Source: Microsoft Learn: Interactive Services (all services run in session 0) (opens in a new tab)
- Instances
- Count copies with Get-CimInstance Win32_Process, or windows.pslist in memory, on a clean machine of the same build.None where the Spooler service is disabled, which Microsoft's guidance allows on a server that is neither a print server nor a domain controller.
- Starts
- At start-up, running until Windows shuts downSources: Microsoft Learn: Introduction to Spooler Components (opens in a new tab), Print Spooler (opens in a new tab)Fast Startup hibernates the kernel session when Windows shuts down, so its start dates from the last full boot, such as a restart.
- Command Line
- Read it elevated with Get-CimInstance Win32_Process, or windows.cmdline in memory, and compare with a clean machine of the same build.
- Signed By
- Check the file with Sigcheck or Get-AuthenticodeSignature, because many Windows files are signed through a catalogue, not in the file itself.
A value that published detection rules check for.No public source states this value, so compare with a clean machine of the same Windows build.
Why It Matters
It runs from start-up until Windows shuts down and takes print calls from other machines, so a thread another process starts in it or a connection to the internet deserves a look. Elastic and SigmaHQ both flag unusual children of it.
What It Does
spoolsv.exe is the print spooler's API server, the service that answers every program's requests to print, and it starts with the operating system. It takes print calls from programs on this machine and, over the network, from other machines, and passes most of them on to a print provider. The spooler is loaded at start-up and runs until Windows shuts down. Behind it sit the router, spoolss.dll, the print providers and the print monitors, spooler components that all run in user mode, outside the kernel. A shell or script under it, or a module new to the machine, is the odd thing to look for.
A thread, one path of execution inside a process, deserves a look when another process starts it in spoolsv.exe. Sysmon event 8 in Microsoft-Windows-Sysmon/Operational records one where Sysmon is configured to log it, and so does the CreateRemoteThreadApiCall action in the DeviceEvents table of Defender XDR. An outbound connection from it to the internet, with no printer or print server behind it, points the same way.
Its children are the other place to look. Elastic flags children of spoolsv.exe running at System integrity, the level Windows gives its system services, apart from printing and driver tools, and SigmaHQ has a matching rule. The Registry's print monitors key names DLLs the spooler loads at start-up.
Microsoft's service guidance for Windows Server marks the Print Spooler as OK to disable on a server that is neither a print server nor a domain controller.
How Attackers Abuse It
Each line is a way this process is misused, with the page that shows how to spot it.
- Code put into spoolsv.exe runs under a trusted service's name, and the trace is a thread that starts in memory no file backs.Remote Thread Injection
- A DLL registered as a print monitor loads into spoolsv.exe at every start, from a folder or a name Windows does not ship.Unsigned or Oddly Signed Modules
In the Process Tree
These are the rows of the process list that this page explains.
spoolsv.exePrint SpoolerOpen it in the tree: spoolsv.exe
On ws-042, 12 Oct 2026
spoolsv.exePrint SpoolerGenuine, code injectedOpen it in the tree: spoolsv.exe
Red Flags
Each sign below links to the page that shows how to confirm it.
- A thread another process started in it, or executable memory no file backs.Remote Thread Injection
- A connection to an internet address with no printer or print server behind it.Network Connections That Should Not Exist
- A shell or script host as its child at System integrity, or any parent but services.exe.Wrong Parent
- Any folder but System32.Wrong Path
- A print monitor or driver DLL in it that is unsigned or new to the machine.Unsigned or Oddly Signed Modules
How to Check It
Each page shows how to check this process, on a running machine and in a memory image.
What Records It
Each record names its log and what must be switched on to get it.
| Record and Where It Lands | What to Read | How to Turn It On |
|---|---|---|
8 CreateMicrosoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | TargetImage spoolsv.exe, with the SourceImage that started the thread. StartModule can be empty when the thread starts outside every loaded module.Checking for Injected Code shows how to read it. | Run Sysmon with Create |
CreateDeviceEventsDefender XDR, advanced hunting | Rows whose FileName is spoolsv.exe, with the Initiating | The Defender for Endpoint sensor on the device |
| Device | Initiating | The Defender for Endpoint sensor on the device |
1 Process creation (opens in a new tab)Microsoft-Windows-Sysmon/OperationalIt is written on any Windows computer running Sysmon. | ParentImage spoolsv.exe on anything it starts, with its IntegrityLevel and CommandLine.Process Trees and Call Chains shows how to read it. | Run Sysmon with ProcessCreate events in its configuration. |
Hunt It
The same hunt is written for four tools, so pick the one you use. Defender XDR and Sentinel queries are in KQL, which you paste into Advanced hunting in the Defender portal or into Sentinel's Logs page. Splunk queries are in SPL, for its Search page, and Velociraptor queries are in VQL, which you run as a hunt.
Reads the DeviceProcessEvents table in Defender XDR advanced hunting, from devices onboarded to Defender for Endpoint, so it holds only copies started while the sensor ran. Check that a recent boot shows the genuine copy before you read no rows as clean. A hit is a lead until its file and creator are checked. A blank signature means unknown, not unsigned, because DeviceFileCertificateInfo holds only files the sensor has checked.
// spoolsv.exe copies whose parent, path or signature breaks its profileDeviceProcessEvents| where Timestamp > ago(Sources
- Microsoft Learn: Introduction to Spooler Components (opens in a new tab)
- Microsoft Learn: Print Spooler (opens in a new tab)
- Microsoft Learn: Mandatory Integrity Control (opens in a new tab)
- Microsoft Learn: Interactive Services (all services run in session 0) (opens in a new tab)
- Elastic: Unusual Parent-Child Relationship (opens in a new tab)
- Elastic: Unusual Print Spooler Child Process (opens in a new tab)
- SigmaHQ: Suspicious Spool Service Child Process (opens in a new tab)
- SigmaHQ: System File Execution Location Anomaly (opens in a new tab)
- Microsoft Sysinternals: Sysmon, event ID 8 CreateRemoteThread (opens in a new tab)
- Microsoft Learn: Security guidelines for system services in Windows Server (opens in a new tab)
- Microsoft Learn: Fast startup causes hibernation or shutdown to fail (opens in a new tab)
- Velociraptor: Windows.System.Pslist (opens in a new tab)