Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation
Flags Windows file events referencing a specific spooler driver path pattern associated with CVE-2021-1675 PoC activity.
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-06-29
- Updated
- 2026-07-31
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows file creation or modification events whose target filename contains a specific PoC path segment associated with print spooler exploitation attempts for CVE-2021-1675. Attackers may use this predictable filename pattern when dropping or referencing payload components to trigger the vulnerability. It relies on file event telemetry that records the target filename and supports substring matching against the observed path.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
- web.archive.orghttps://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
- github.comhttps://github.com/cube0x0/CVE-2021-1675
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_event_win_exploit_cve_2021_1675_printspooler.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation"
id: d10eb4aa-eabe-4a0a-be24-52b0de72489e
status: test
description: This rule matches Windows file creation or modification events whose target filename contains a specific PoC path segment associated with print spooler exploitation attempts for CVE-2021-1675. Attackers may use this predictable filename pattern when dropping or referencing payload components to trigger the vulnerability. It relies on file event telemetry that records the target filename and supports substring matching against the observed path.
references:
- https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
- https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
- https://github.com/cube0x0/CVE-2021-1675
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_event_win_exploit_cve_2021_1675_printspooler.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-06-29
modified: 2022-12-25
tags:
- attack.execution
- attack.privilege-escalation
- attack.resource-development
- attack.t1587
- cve.2021-1675
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: C:\Windows\System32\spool\drivers\x64\3\old\1\123
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 2131cfb3-8c12-45e8-8fa0-31f5924e9f07
type: derived