T1212 Exploitation for Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials. MITRE ATT&CK
1 Sigma rule T1212 on attack.mitre.org
Sigma rules tagged with it
highSuspicious NTLM Authentication on the Printer Spooler ServiceElastic (idea), Tobias Michalski (Nextron Systems) · Windows