Windows File Deletion Monitoring for Spooler Driver Folder DLL Removal

title: Windows File Deletion Monitoring for Spooler Driver Folder DLL Removal
id: 35570ed6-0ef5-4521-8339-bdf4e625dc6e
status: test
description: This rule flags deletion activity targeting a specific Spooler Service driver folder path on Windows, where spoolsv.exe performs the file removal. Attackers may use this kind of file manipulation to interfere with printing-related components as part of privilege escalation or persistence attempts. It relies on file deletion telemetry that includes the process image path and the deleted target filename.
references:
  - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  - https://github.com/cube0x0/CVE-2021-1675
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_delete_win_exploit_cve_2021_1675_print_nightmare.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-07-01
modified: 2023-02-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574
  - cve.2021-1675
  - detection.emerging-threats
logsource:
  category: file_delete
  product: windows
detection:
  selection:
    Image|endswith: \spoolsv.exe
    TargetFilename|contains: C:\Windows\System32\spool\drivers\x64\3\
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
    type: derived