Zeek DCE/RPC: Remote Print Driver or Print Processor Installation Activity
Alerts on Zeek DCE-RPC RPC operations that remotely add printer drivers or print processors.
FreeReviewedSigma · Medium · v5
- Product
- zeek
- Service
- dce_rpc
- Author
- @neu5ron (Nate Guagenti) (SigmaHQ), DRL 1.1
- Published
- 2021-08-23
- Updated
- 2026-07-31
What it detects
This rule flags DCE/RPC operations that add or install printer drivers and related print processors, which can indicate printer-spooler exploitation such as PrintNightmare. Remote driver installation is typically uncommon because drivers are usually installed locally or via group policy. The detection relies on Zeek telemetry for DCE/RPC service calls and matches specific printer-driver/processor RPC operation names.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29
- github.comhttps://github.com/zeek/zeek/blob/691b099de13649d6576c7b9d637f8213ff818832/scripts/base/protocols/dce-rpc/consts.zeek
- msrc.microsoft.comhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
- github.comhttps://github.com/corelight/CVE-2021-1675
- old.zeek.orghttps://old.zeek.org/zeekweek2019/slides/bzar.pdf
- crowdstrike.comhttps://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/zeek_dce_rpc_exploit_cve_2021_1675_printnightmare_print_driver_install.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
zeek-dce-rpc-remote-printer-driver-and-print-processor-installation-activity-pri-7b33baef
title: "Zeek DCE/RPC: Remote Print Driver or Print Processor Installation Activity"
id: e40aa740-802b-4436-8881-93c9d2e30611
related:
- id: 53389db6-ba46-48e3-a94c-e0f2cefe1583
type: derived
- id: 7b33baef-2a75-4ca3-9da4-34f9a15382d8
type: derived
status: stable
description: This rule flags DCE/RPC operations that add or install printer drivers and related print processors, which can indicate printer-spooler exploitation such as PrintNightmare. Remote driver installation is typically uncommon because drivers are usually installed locally or via group policy. The detection relies on Zeek telemetry for DCE/RPC service calls and matches specific printer-driver/processor RPC operation names.
references:
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29
- https://github.com/zeek/zeek/blob/691b099de13649d6576c7b9d637f8213ff818832/scripts/base/protocols/dce-rpc/consts.zeek
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
- https://github.com/corelight/CVE-2021-1675
- https://old.zeek.org/zeekweek2019/slides/bzar.pdf
- https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/zeek_dce_rpc_exploit_cve_2021_1675_printnightmare_print_driver_install.yml
author: "@neu5ron (Nate Guagenti), Huntrule Team"
date: 2021-08-23
modified: 2025-11-03
tags:
- attack.execution
- cve.2021-1678
- cve.2021-1675
- cve.2021-34527
- detection.emerging-threats
logsource:
product: zeek
service: dce_rpc
detection:
selection:
operation:
- RpcAsyncInstallPrinterDriverFromPackage
- RpcAsyncAddPrintProcessor
- RpcAddPrintProcessor
- RpcAddPrinterDriverEx
- RpcAddPrinterDriver
- RpcAsyncAddPrinterDriver
condition: selection
falsepositives:
- Legitimate remote alteration of a printer driver.
level: medium
license: DRL-1.1