Suspicious Spool Service Child Process — Detection Rule

Detects suspicious print spool service (spoolsv.exe) child processes.

Read the full analysis on IntelFusions