huntrule

Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation

Flags Windows file events referencing a specific spooler driver path pattern associated with CVE-2021-1675 PoC activity.

FreeReviewedSigma · Critical · v5
Product
windows
Category
file_event
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-06-29
Updated
2026-07-31
AnalysisDetection
title: "Windows File Events: PoC Filename Pattern for CVE-2021-1675 Spooler Exploitation"
id: d10eb4aa-eabe-4a0a-be24-52b0de72489e
status: test
description: This rule matches Windows file creation or modification events whose target filename contains a specific PoC path segment associated with print spooler exploitation attempts for CVE-2021-1675. Attackers may use this predictable filename pattern when dropping or referencing payload components to trigger the vulnerability. It relies on file event telemetry that records the target filename and supports substring matching against the observed path.
references:
  - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
  - https://github.com/cube0x0/CVE-2021-1675
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/file_event_win_exploit_cve_2021_1675_printspooler.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-06-29
modified: 2022-12-25
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.resource-development
  - attack.t1587
  - cve.2021-1675
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: C:\Windows\System32\spool\drivers\x64\3\old\1\123
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 2131cfb3-8c12-45e8-8fa0-31f5924e9f07
    type: derived