huntrule

Windows Print Spooler Exploitation Indicators: UNIDRV.DLL and mimispool Driver Loads (Event ID 316)

Flags Windows Print Spooler Event ID 316 entries containing UNIDRV/mimispool-related keywords indicative of CVE-2021-1675 exploitation.

FreeReviewedSigma · Critical · v5
Product
windows
Service
printservice-operational
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-07-01
Updated
2026-07-31
AnalysisDetection
title: "Windows Print Spooler Exploitation Indicators: UNIDRV.DLL and mimispool Driver Loads (Event ID 316)"
id: 80ad7dd3-75ab-4794-9abb-ffcc39abdda6
status: test
description: This rule identifies likely successful exploitation attempts of the Windows Print Spooler by matching specific driver-load activity in the PrintServiceOperational log. The behavior matters because attackers abusing the spooler can execute malicious code via loaded components and related payload naming. It relies on Event ID 316 and the presence of targeted strings (including UNIDRV.DLL and mimispool) within the event data.
references:
  - https://twitter.com/MalwareJake/status/1410421967463731200
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler_operational.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-01
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1569
  - cve.2021-1675
  - detection.emerging-threats
logsource:
  product: windows
  service: printservice-operational
detection:
  selection:
    EventID: 316
  keywords:
    - "UNIDRV.DLL, kernelbase.dll, "
    - " 123 "
    - " 1234 "
    - mimispool
  condition: selection and keywords
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: f34d942d-c8c4-4f1f-b196-22471aecf10a
    type: derived