Windows Registry Change: New Print Port Entries with Executable/Script Extensions

Flags registry modifications to the Ports key with path- or executable/script-like details that may indicate printer-based exploitation attempts.

FreeUnreviewedSigmahighv1

windows-registry-change-new-print-port-entries-with-executable-script-extensions-7ec912f2

title: "Windows Registry Change: New Print Port Entries with Executable/Script Extensions"
id: 7be08559-e662-486a-87d2-974494610b6a
status: test
description: This rule identifies registry updates to the Windows NT CurrentVersion Ports key where the entry details include Windows paths or executable/script file extensions. Such changes can indicate an attacker attempting to leverage the printing subsystem for privilege escalation or persistence by configuring port-related functionality. The detection relies on Windows registry set telemetry, specifically matching TargetObject contents for the Ports key and Details strings that contain extensions like .bat, .exe, .dll, and .ps1.
references:
  - https://windows-internals.com/printdemon-cve-2020-1048/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1048/registry_set_exploit_cve_2020_1048_new_printer_port.yml
author: EagleEye Team, Florian Roth (Nextron Systems), NVISO, Huntrule Team
date: 2020-05-13
modified: 2024-03-25
tags:
  - attack.persistence
  - attack.execution
  - attack.defense-impairment
  - attack.t1112
  - cve.2020-1048
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Ports
    Details|contains:
      - .bat
      - .com
      - .dll
      - .exe
      - .ps1
      - .vbe
      - .vbs
      - "C:"
  condition: selection
falsepositives:
  - New printer port install on host
level: high
license: DRL-1.1
related:
  - id: 7ec912f2-5175-4868-b811-ec13ad0f8567
    type: derived

What it detects

This rule identifies registry updates to the Windows NT CurrentVersion Ports key where the entry details include Windows paths or executable/script file extensions. Such changes can indicate an attacker attempting to leverage the printing subsystem for privilege escalation or persistence by configuring port-related functionality. The detection relies on Windows registry set telemetry, specifically matching TargetObject contents for the Ports key and Details strings that contain extensions like .bat, .exe, .dll, and .ps1.

Known false positives

New printer port install on host

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.