Windows Print Spooler Module Load Failures Indicating Possible CVE-2021-1675 Exploitation

title: Windows Print Spooler Module Load Failures Indicating Possible CVE-2021-1675 Exploitation
id: 8560bfc5-7865-4d65-9e93-f76fd550b31a
status: test
description: This rule flags Windows Print Spooler events that include a driver or plug-in module load error (EventID 808 with specific ErrorCode values) and related module-load failure keywords. Attackers may exploit print spooler vulnerabilities to execute code via loaded modules, so these error patterns can reflect exploitation attempts or failed stages. It relies on PrintService/Admin log telemetry containing EventID 808, ErrorCode, and the module-load failure text, while excluding a known “registration timed out” scenario to reduce false positives.
references:
  - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
  - https://twitter.com/fuzzyf10w/status/1410202370835898371
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler.yml
author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton, Huntrule Team
date: 2021-06-30
modified: 2022-11-15
tags:
  - attack.execution
  - attack.t1569
  - cve.2021-1675
  - detection.emerging-threats
logsource:
  product: windows
  service: printservice-admin
detection:
  selection:
    EventID: 808
    ErrorCode:
      - "0x45A"
      - "0x7e"
  keywords:
    - The print spooler failed to load a plug-in module
    - MyExploit.dll
    - evil.dll
    - \addCube.dll
    - \rev.dll
    - \rev2.dll
    - \main64.dll
    - \mimilib.dll
    - \mimispool.dll
  falsepositive:
    - " registration timed out"
  condition: (selection or keywords) and not falsepositive
falsepositives:
  - Problems with printer drivers
level: high
license: DRL-1.1
related:
  - id: 4e64668a-4da1-49f5-a8df-9e2d5b866718
    type: derived