Windows Print Spooler Plugin Load Errors Indicative of CVE-2021-1675 Exploitation
Looks for Print Spooler plug-in/module load errors in Windows logs that may indicate CVE-2021-1675 exploitation attempts.
- Product
- windows
- Service
- printservice-admin
- Author
- Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2021-06-30
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows print service (PrintServiceAdmin) events where the print spooler reports driver load or plugin-module load failures with specific error codes, and where log text matches known plugin failure wording. These errors can indicate an attempt to exploit the print spooler vulnerability associated with CVE-2021-1675, including attempts to load malicious DLLs. It relies on telemetry from printservice-admin logs, specifically EventID 808, error codes, and keyword strings describing failed module/plugin loading.
Reporting behind it
- web.archive.orghttps://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
- web.archive.orghttps://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
- twitter.comhttps://twitter.com/fuzzyf10w/status/1410202370835898371
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Print Spooler Plugin Load Errors Indicative of CVE-2021-1675 Exploitation
id: 8560bfc5-7865-4d65-9e93-f76fd550b31a
status: test
description: This rule flags Windows print service (PrintServiceAdmin) events where the print spooler reports driver load or plugin-module load failures with specific error codes, and where log text matches known plugin failure wording. These errors can indicate an attempt to exploit the print spooler vulnerability associated with CVE-2021-1675, including attempts to load malicious DLLs. It relies on telemetry from printservice-admin logs, specifically EventID 808, error codes, and keyword strings describing failed module/plugin loading.
references:
- https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
- https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
- https://twitter.com/fuzzyf10w/status/1410202370835898371
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler.yml
author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton, Huntrule Team
date: 2021-06-30
modified: 2022-11-15
tags:
- attack.execution
- attack.t1569
- cve.2021-1675
- detection.emerging-threats
logsource:
product: windows
service: printservice-admin
detection:
selection:
EventID: 808
ErrorCode:
- "0x45A"
- "0x7e"
keywords:
- The print spooler failed to load a plug-in module
- MyExploit.dll
- evil.dll
- \addCube.dll
- \rev.dll
- \rev2.dll
- \main64.dll
- \mimilib.dll
- \mimispool.dll
falsepositive:
- " registration timed out"
condition: (selection or keywords) and not falsepositive
falsepositives:
- Problems with printer drivers
level: high
license: DRL-1.1
related:
- id: 4e64668a-4da1-49f5-a8df-9e2d5b866718
type: derived