TA0003 · PERSISTENCE
Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Detect it with
Monitor process API calls to AddMonitor . Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal.
Why it matters on shift
Port Monitors is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context