Windows Registry Printer Driver Installations with Empty Manufacturer Field

title: Windows Registry Printer Driver Installations with Empty Manufacturer Field
id: 9811f785-5758-402d-be4c-676a15897cd0
status: test
description: This rule flags printer driver installation changes in the Windows registry where the targeted driver environment path contains a Manufacturer field with the value explicitly set to empty. Attackers can use malformed or incomplete driver metadata to persist or evade normal driver inventory and validation. The detection relies on registry set telemetry for updates under the Windows x64 printer driver environments path and matches the presence of an empty Manufacturer entry while excluding known benign driver identifiers.
references:
  - https://twitter.com/SBousseaden/status/1410545674773467140
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_printer_driver.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-01
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574
  - cve.2021-1675
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains|all:
      - \Control\Print\Environments\Windows x64\Drivers
      - \Manufacturer
    Details: (Empty)
  filter_cutepdf:
    TargetObject|contains: \CutePDF Writer v4.0\
  filter_vnc:
    TargetObject|contains:
      - \VNC Printer (PS)\
      - \VNC Printer (UD)\
  filter_pdf24:
    TargetObject|contains: \Version-3\PDF24\
  condition: selection and not 1 of filter_*
falsepositives:
  - Alerts on legitimate printer drivers that do not set any more details in the Manufacturer value
level: high
license: DRL-1.1
related:
  - id: e0813366-0407-449a-9869-a2db1119dc41
    type: derived