Detection rules › Sigma
SystemNightmare by GentilKiwi - New external device added (CVE-2021-1675 / CVE-2021-34527)
Detects scenarios where an attacker exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1574.002 Hijack Execution Flow: DLL Side-Loading |
| Privilege Escalation | T1547.010 Boot or Logon Autostart Execution: Port Monitors |
| Stealth | T1574.002 Hijack Execution Flow: DLL Side-Loading |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 6416 | A new external device was recognized by the system. |
Rule body yaml
title: SystemNightmare by GentilKiwi - New external device added (CVE-2021-1675 / CVE-2021-34527)
description: Detects scenarios where an attacker exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1574-DLL%20side-loading
- https://github.com/GossiTheDog/SystemNightmare
- https://github.com/outflanknl/PrintNightmare
- https://github.com/cube0x0/CVE-2021-1675
- https://www.theregister.com/2021/09/21/microsoft_printnightmare/
- https://www.exabeam.com/information-security/detecting-the-printnightmare-cve-2021-1675-34527-vulnerability-using-exabeam/
tags:
- attack.privilege_escalation
- attack.t1574.002
- attack.t1547.010
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection: # net use \\printnightmare.gentilkiwi.com\ipc$ /user:gentilguest password
selection:
EventID: 6416
DeviceDescription|contains: # original: '\\printnightmare.gentilkiwi.com\Kiwi Legit Printer'
- printnightmare
- gentil
- kiwi
condition: selection
falsepositives:
- pentest
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 6416
DeviceDescription|contains:
- printnightmare
- gentil
- kiwi
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
DeviceDescription | match |
|