Detection rules › By event

Microsoft-Windows-PrintService

Event	Rules
Event ID 316	3
Event ID 321	1
Event ID 354	1
Event ID 808	3
Event ID 4909	1

Event ID 316

3 detection rules reference this event. View event page.

Sigma (1)

CVE-2021-1675 Print Spooler Exploitation severity critical T1569

Splunk (2)

Additional dll added to Spool Driver (Windows Event Log) T1547
Print Spooler Adding A Printer Driver severity medium T1547, T1547.012

Event ID 321

1 detection rules reference this event. View event page.

Sigma (1)

Mimispool printer driver installation (PrintNightmare vulnerability - CVE-2021-36958) severity high T1574, T1574.001

Event ID 354

1 detection rules reference this event. View event page.

Sigma (1)

Mimispool printer driver installation (PrintNightmare vulnerability - CVE-2021-36958) severity high T1574, T1574.001

Event ID 808

3 detection rules reference this event. View event page.

Sigma (2)

Mimispool printer driver installation (PrintNightmare vulnerability - CVE-2021-36958) severity high T1574, T1574.001
Possible CVE-2021-1675 Print Spooler Exploitation severity high T1569

Splunk (1)

Print Spooler Failed to Load a Plug-in severity medium T1547, T1547.012

Event ID 4909

1 detection rules reference this event. View event page.

Splunk (1)

Print Spooler Failed to Load a Plug-in severity medium T1547, T1547.012