Windows SystemNightmare Exploitation Attempt via PrintNightmare CLI Indicators

Alerts on Windows process command lines matching SystemNightmare/PrintNightmare exploitation indicators that may enable LOCAL_SYSTEM shell access.

FreeUnreviewedSigmacriticalv1

windows-systemnightmare-exploitation-attempt-via-printnightmare-cli-indicators-c01f7bd6

title: Windows SystemNightmare Exploitation Attempt via PrintNightmare CLI Indicators
id: dca4caf4-c981-4955-a768-3fa38f2cd896
status: test
description: This rule flags Windows process creations whose command line contains indicators associated with attempting SystemNightmare exploitation through a PrintNightmare-related workflow. The behavior matters because successful exploitation can lead to privilege escalation and an attacker obtaining a shell with LOCAL_SYSTEM context. The detection relies on command-line substrings observed in process creation telemetry, specifically matching the referenced host and execution parameters.
references:
  - https://github.com/GossiTheDog/SystemNightmare
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/SystemNightmare-Exploit/proc_creation_win_exploit_other_systemnightmare.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-11
modified: 2023-02-04
tags:
  - attack.privilege-escalation
  - attack.t1068
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - printnightmare.gentilkiwi.com
      - " /user:gentilguest "
      - Kiwi Legit Printer
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: c01f7bd6-0c1d-47aa-9c61-187b91273a16
    type: derived

What it detects

This rule flags Windows process creations whose command line contains indicators associated with attempting SystemNightmare exploitation through a PrintNightmare-related workflow. The behavior matters because successful exploitation can lead to privilege escalation and an attacker obtaining a shell with LOCAL_SYSTEM context. The detection relies on command-line substrings observed in process creation telemetry, specifically matching the referenced host and execution parameters.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.