detection.wiki

Detection rules › Sigma

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Status
test
Severity
critical
Log source
category file_event, product windows
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

MITRE ATT&CK coverage

TacticTechniques
Resource Development

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 11: FileCreate

Rule body

title: CVE-2021-1675 Print Spooler Exploitation Filename Pattern
id: 2131cfb3-8c12-45e8-8fa0-31f5924e9f07
status: test
description: Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675
references:
    - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
    - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
    - https://github.com/cube0x0/CVE-2021-1675
author: Florian Roth (Nextron Systems)
date: 2021-06-29
modified: 2022-12-25
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.resource-development
    - attack.t1587
    - cve.2021-1675
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'C:\Windows\System32\spool\drivers\x64\3\old\1\123'
    condition: selection
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetFilename|contains: 'C:\Windows\System32\spool\drivers\x64\3\old\1\123'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetFilenamematch
  • C:\Windows\System32\spool\drivers\x64\3\old\1\123
field:"TargetFilename" kind:match value:"C:\Windows\System32\spool\drivers\x64\3\old\1\123"