Zeek DCE-RPC: Remote Printer Driver and Print Processor Installation Activity (PrintNightmare)

Alerts on Zeek DCE-RPC RPC operations that remotely add printer drivers or print processors.

FreeUnreviewedSigmamediumv1

zeek-dce-rpc-remote-printer-driver-and-print-processor-installation-activity-pri-7b33baef

title: "Zeek DCE-RPC: Remote Printer Driver and Print Processor Installation Activity (PrintNightmare)"
id: e40aa740-802b-4436-8881-93c9d2e30611
related:
  - id: 53389db6-ba46-48e3-a94c-e0f2cefe1583
    type: derived
  - id: 7b33baef-2a75-4ca3-9da4-34f9a15382d8
    type: derived
status: stable
description: This rule flags DCE-RPC calls in which remote systems install printer drivers or add print processors via RPC operations. Such behavior is notable because printer driver installation is typically local or controlled through mechanisms like group policy rather than ad-hoc remote RPC. The detection relies on Zeek DCE-RPC telemetry capturing specific RPC operation names associated with adding printer drivers and processors.
references:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29
  - https://github.com/zeek/zeek/blob/691b099de13649d6576c7b9d637f8213ff818832/scripts/base/protocols/dce-rpc/consts.zeek
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
  - https://github.com/corelight/CVE-2021-1675
  - https://old.zeek.org/zeekweek2019/slides/bzar.pdf
  - https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/zeek_dce_rpc_exploit_cve_2021_1675_printnightmare_print_driver_install.yml
author: "@neu5ron (Nate Guagenti), Huntrule Team"
date: 2021-08-23
modified: 2025-11-03
tags:
  - attack.execution
  - cve.2021-1678
  - cve.2021-1675
  - cve.2021-34527
  - detection.emerging-threats
logsource:
  product: zeek
  service: dce_rpc
detection:
  selection:
    operation:
      - RpcAsyncInstallPrinterDriverFromPackage
      - RpcAsyncAddPrintProcessor
      - RpcAddPrintProcessor
      - RpcAddPrinterDriverEx
      - RpcAddPrinterDriver
      - RpcAsyncAddPrinterDriver
  condition: selection
falsepositives:
  - Legitimate remote alteration of a printer driver.
level: medium
license: DRL-1.1

What it detects

This rule flags DCE-RPC calls in which remote systems install printer drivers or add print processors via RPC operations. Such behavior is notable because printer driver installation is typically local or controlled through mechanisms like group policy rather than ad-hoc remote RPC. The detection relies on Zeek DCE-RPC telemetry capturing specific RPC operation names associated with adding printer drivers and processors.

Known false positives

Legitimate remote alteration of a printer driver.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.