Boot or Logon Autostart Execution: Port Monitors
- ID
- T1547.010
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1547 Boot or Logon Autostart Execution
- Platforms
- Windows
- Data sources
- Process Creation, Module Load, Windows Registry Key Modification, File Creation, OS API Execution
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.[1] This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, spoolsv.exe, under SYSTEM level permissions on boot.[2]
Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the Driver value of an existing or new arbitrarily named subkey of HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. The Registry key contains entries for the following:
- Local Port
- Standard TCP/IP Port
- USB Monitor
- WSD Port
Detection
- DET0204 Detection Strategy for T1547.010 – Port Monitor DLL Persistence via spoolsv.exe (Windows)
Data components: Process Creation, Module Load, Windows Registry Key Modification, File Creation, OS API Execution