Windows PrinterNightmare Exploit File Drop via Antivirus Detection

Alerts on antivirus events where filenames include the Windows spooler driver x64 directory path, excluding Symantec submission messages.

FreeUnreviewedSigmacriticalv1

windows-printernightmare-exploit-file-drop-via-antivirus-detection-6fe1719e

title: Windows PrinterNightmare Exploit File Drop via Antivirus Detection
id: 63499f04-bb92-41d4-8a11-f6978a02d610
status: stable
description: This rule flags the creation of a suspicious file path consistent with Windows Print Spooler driver storage associated with PrinterNightmare-style activity. Attackers may place or submit a payload to the spooler driver directory as part of remote code execution attempts, making this file-drop pattern a useful high-signal indicator. It relies on antivirus telemetry that captures filenames and includes a guard to ignore entries containing the specific keyword 'File submitted to Symantec'.
references:
  - https://twitter.com/mvelazco/status/1410291741241102338
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/av_exploit_cve_2021_34527_print_nightmare.yml
author: Sittikorn S, Nuttakorn T, Tim Shelton, Huntrule Team
date: 2021-07-01
modified: 2023-10-23
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - detection.emerging-threats
  - cve.2021-34527
  - cve.2021-1675
logsource:
  category: antivirus
detection:
  selection:
    Filename|contains: :\Windows\System32\spool\drivers\x64\
  keywords:
    - File submitted to Symantec
  condition: selection and not keywords
falsepositives:
  - Unlikely, or pending PSP analysis
level: critical
license: DRL-1.1
related:
  - id: 6fe1719e-ecdf-4caf-bffe-4f501cb0a561
    type: derived

What it detects

This rule flags the creation of a suspicious file path consistent with Windows Print Spooler driver storage associated with PrinterNightmare-style activity. Attackers may place or submit a payload to the spooler driver directory as part of remote code execution attempts, making this file-drop pattern a useful high-signal indicator. It relies on antivirus telemetry that captures filenames and includes a guard to ignore entries containing the specific keyword 'File submitted to Symantec'.

Known false positives

Unlikely, or pending PSP analysis

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.