Windows Registry: Flag Print Driver Registry Paths for QMS 810 and mimikatz

Detects registry TargetObject entries containing QMS 810 or mimikatz-related printer driver names under Windows print environments.

FreeReviewedSigma · Critical · v5

Product: windows
Category: registry_event
Author: Markus Neis, @markus_neis, Florian Roth (SigmaHQ), DRL 1.1
Published: 2021-07-04
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1204User Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows registry activity where TargetObject contains known print driver path strings associated with QMS 810 or the mimikatz printer naming. Attackers leveraging printer-spooler impersonation may write or reference these specific driver names to trigger malicious execution via installed driver components. The detection relies on registry event telemetry capturing TargetObject content under the Control\Print\Environments hierarchy and includes additional strings like “Gentil Kiwi” and “mimikatz printer”.

Reporting behind it

Related detections9 linkedT1204 — drag to rearrange

Malicious Edge Abuse for Payload Download via Console (via process_creation)

Obfuscated Edge/Chrome Headless Feature Abuse for Payload Download (via process_creation)

Windows Process Creation: File Upload Clickfix Lure via Browser to Command Execution

Windows ClickFix/FileFix Clipboard Phishing Leading to Suspicious mshta/powershell Command Execution

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Windows Registry RunMRU Path with Suspicious Space Characters and Delimiter

Windows Registry: Suspicious Space-Padded TypedPaths Details String

Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1

Windows: Deno writes files from remote HTTPS content into AppData

Windows Registry: Flag Print Driver Registry Paths for QMS 810 and mimikatz

Pivot detection · T1204 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-monitoring-for-print-driver-path-names-used-by-mimikatz-ba6b9e43

title: "Windows Registry: Flag Print Driver Registry Paths for QMS 810 and mimikatz"
id: 52f885a9-f47b-45b3-98cc-3647060982e0
status: test
description: This rule flags Windows registry activity where TargetObject contains known print driver path strings associated with QMS 810 or the mimikatz printer naming. Attackers leveraging printer-spooler impersonation may write or reference these specific driver names to trigger malicious execution via installed driver components. The detection relies on registry event telemetry capturing TargetObject content under the Control\Print\Environments hierarchy and includes additional strings like “Gentil Kiwi” and “mimikatz printer”.
references:
  - https://github.com/gentilkiwi/mimikatz/commit/c21276072b3f2a47a21e215a46962a17d54b3760
  - https://www.lexjansen.com/sesug/1993/SESUG93035.pdf
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913
  - https://nvd.nist.gov/vuln/detail/cve-2021-1675
  - https://nvd.nist.gov/vuln/detail/cve-2021-34527
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/registry_event_cve_2021_1675_mimikatz_printernightmare_drivers.yml
author: Markus Neis, @markus_neis, Florian Roth, Huntrule Team
date: 2021-07-04
modified: 2023-06-12
tags:
  - attack.execution
  - attack.t1204
  - cve.2021-1675
  - cve.2021-34527
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    TargetObject|contains:
      - \Control\Print\Environments\Windows x64\Drivers\Version-3\QMS 810\
      - \Control\Print\Environments\Windows x64\Drivers\Version-3\mimikatz
  selection_alt:
    TargetObject|contains|all:
      - legitprinter
      - \Control\Print\Environments\Windows
  selection_print:
    TargetObject|contains:
      - \Control\Print\Environments
      - \CurrentVersion\Print\Printers
  selection_kiwi:
    TargetObject|contains:
      - Gentil Kiwi
      - mimikatz printer
      - Kiwi Legit Printer
  condition: selection or selection_alt or (selection_print and selection_kiwi)
falsepositives:
  - Legitimate installation of printer driver QMS 810, Texas Instruments microLaser printer (unlikely)
level: critical
license: DRL-1.1
related:
  - id: ba6b9e43-1d45-4d3c-a504-1043a64c8469
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL