Print Monitors

A port monitor DLL the print spooler loads as SYSTEM at boot and on service start.

Use it to find a DLL the print spooler loads as SYSTEM, and tell it apart from the built-in port monitors.

SYSTEM
Persistence

What It Is

A port monitor is a user-mode DLL that gives the print spooler a communications path to a printer port and manages the server's printer ports. The spooler loads the port monitors installed on the system, and each monitor supports one or more ports. Their configuration is stored under the Monitors key in HKLM SYSTEM under CurrentControlSet\Control\Print, with a subkey for each monitor. Localmon.dll, the sample local port monitor, is a built-in example.

What It Proves

A Driver value under a Monitors subkey is a DLL loaded by the spooler service, which runs as SYSTEM. It gives persistence and a SYSTEM context across reboots.

What It Does Not Prove

Printer and port software adds genuine monitors, so judge by the DLL path and name. It shows what is registered, not a record that the spooler loaded it.

Where It Lives

Print Monitors lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Control\Print\Monitors\<name>

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Print Monitors, each with what it tells you
Registry Value	What It Tells You
`Local Port\Driver` `REG_SZlocalspl.dll`	The Local Port monitor is localspl.dll, a genuine Windows printing component the spooler loads. Resolve every Driver value the same way.
`Standard TCP/IP Port\Driver` `REG_SZtcpmon.dll`	The Standard TCP/IP Port monitor is tcpmon.dll, a built-in driver the spooler loads as SYSTEM. A Driver outside System32 or an unknown name is the signal.
`USB Monitor\Driver` `REG_SZusbmon.dll`	The USB print monitor is usbmon.dll, shipped with Windows. Check the rest of the list too, such as WSD Port, before ruling the key out.

How to Read It

List the subkeys under Print Monitors and read the Driver value in each. Resolve the Driver DLL and compare it with the known printing components. A DLL outside System32, or a monitor with an odd name, is the signal.

When Windows Writes It: When a monitor is registered, by printing software or an attacker with admin rights.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows a monitor registered, not that the spooler loaded it.

KQLDefender XDR, Advanced hunting

// A Driver DLL registered under Print MonitorsDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey contains @"\Control\Print\Monitors\" and RegistryValueName =~ "Driver"| project Timestamp, ActionType, RegistryKey, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Print Monitors shows.

ServicesShows whether the Spooler service is set to start, which is when the monitor loads.
spoolsv.exe Loads a DLL, Sysmon Event 7Not in the RegistryShows the spooler loading the monitor DLL, which the key alone does not.

Sources

The facts on this page come from these public pages, which say more on each point.