Windows Print Spooler Exploitation: UNIDRV/mimispool Driver Load in Event ID 316

title: "Windows Print Spooler Exploitation: UNIDRV/mimispool Driver Load in Event ID 316"
id: 80ad7dd3-75ab-4794-9abb-ffcc39abdda6
status: test
description: This rule identifies print spooler driver load activity that matches specific strings associated with exploitation behavior targeting the Print Spooler vulnerability CVE-2021-1675. Attackers may use these driver load events to gain code execution in the print spooler context. The detection relies on Windows PrintService Operational logs, matching Event ID 316 along with the presence of defined keyword fragments in the event content.
references:
  - https://twitter.com/MalwareJake/status/1410421967463731200
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler_operational.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-01
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1569
  - cve.2021-1675
  - detection.emerging-threats
logsource:
  product: windows
  service: printservice-operational
detection:
  selection:
    EventID: 316
  keywords:
    - "UNIDRV.DLL, kernelbase.dll, "
    - " 123 "
    - " 1234 "
    - mimispool
  condition: selection and keywords
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: f34d942d-c8c4-4f1f-b196-22471aecf10a
    type: derived