Windows Suspicious DLL Deletion in Spooler Driver Folder (PrintNightmare/CVE-2021-1675)
Alerts when spoolsv.exe deletes a DLL from the Spooler driver folder path on Windows.
- Product
- windows
- Category
- file_delete
- Author
- Bhabesh Raj (SigmaHQ), DRL 1.1
- Published
- 2021-07-01
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file deletions of DLLs under the Spooler service driver directory on Windows, where the deleting process is spoolsv.exe. Such activity is consistent with attempts to tamper with or replace print-related driver components to gain elevated access. It relies on Windows file deletion telemetry that includes the deleting process image path and the target filename, matching a specific driver subdirectory path.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
- github.comhttps://github.com/cube0x0/CVE-2021-1675
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_delete_win_exploit_cve_2021_1675_print_nightmare.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Suspicious DLL Deletion in Spooler Driver Folder (PrintNightmare/CVE-2021-1675)
id: 35570ed6-0ef5-4521-8339-bdf4e625dc6e
status: test
description: This rule flags file deletions of DLLs under the Spooler service driver directory on Windows, where the deleting process is spoolsv.exe. Such activity is consistent with attempts to tamper with or replace print-related driver components to gain elevated access. It relies on Windows file deletion telemetry that includes the deleting process image path and the target filename, matching a specific driver subdirectory path.
references:
- https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
- https://github.com/cube0x0/CVE-2021-1675
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_delete_win_exploit_cve_2021_1675_print_nightmare.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-07-01
modified: 2023-02-17
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574
- cve.2021-1675
- detection.emerging-threats
logsource:
category: file_delete
product: windows
detection:
selection:
Image|endswith: \spoolsv.exe
TargetFilename|contains: C:\Windows\System32\spool\drivers\x64\3\
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
type: derived