detection.wiki

Detection rules › Sigma

CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Status
test
Severity
high
Log source
product windows, category registry_set
Author
EagleEye Team, Florian Roth (Nextron Systems), NVISO
Source
github.com/SigmaHQ/sigma

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
id: 7ec912f2-5175-4868-b811-ec13ad0f8567
status: test
description: |
    Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension.
    This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.
references:
    - https://windows-internals.com/printdemon-cve-2020-1048/
author: EagleEye Team, Florian Roth (Nextron Systems), NVISO
date: 2020-05-13
modified: 2024-03-25
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - cve.2020-1048
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Ports'
        Details|contains:
            - '.bat'
            - '.com'
            - '.dll'
            - '.exe'
            - '.ps1'
            - '.vbe'
            - '.vbs'
            - 'C:'
    condition: selection
falsepositives:
    - New printer port install on host
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Ports'
    Details|contains:
        - '.bat'
        - '.com'
        - '.dll'
        - '.exe'
        - '.ps1'
        - '.vbe'
        - '.vbs'
        - 'C:'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • .bat corpus 3 (sigma 3)
  • .com
  • .dll corpus 5 (sigma 5)
  • .exe corpus 4 (sigma 3, splunk 1)
  • .ps1 corpus 2 (sigma 2)
  • .vbe
  • .vbs
  • C:
TargetObjectmatch
  • \Microsoft\Windows NT\CurrentVersion\Ports