Windows File Events: Detect PoC-style Print Spooler filename targeting CVE-2021-1675

title: "Windows File Events: Detect PoC-style Print Spooler filename targeting CVE-2021-1675"
id: d10eb4aa-eabe-4a0a-be24-52b0de72489e
status: test
description: This rule matches Windows file activity where the target filename contains the specific spooler driver path and number sequence used as a default in PrintNightmare PoC code for CVE-2021-1675. Attackers can use this filename pattern to interact with print spooler-related paths during exploitation attempts. The detection relies on file_event telemetry that includes the target filename observed in the event.
references:
  - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
  - https://github.com/cube0x0/CVE-2021-1675
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_event_win_exploit_cve_2021_1675_printspooler.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-06-29
modified: 2022-12-25
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.resource-development
  - attack.t1587
  - cve.2021-1675
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: C:\Windows\System32\spool\drivers\x64\3\old\1\123
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2131cfb3-8c12-45e8-8fa0-31f5924e9f07
    type: derived