Detection rules › Sigma
Discovery for print spooler bug abuse (NTLM hash retrivial) via named pipe
Detects scenarios where an attacker with a responder in place initiates an authenticated callback request from a targeted host with the print spooler service enabled (RpcRemoteFindFirstPrinterChangeNotification abuse). In case the targeted host answers to the responder, the NTLM hash of the computer account will be disclosed. Following that, the hash can be used for different type of abuse like Silver ticket generation or unconstrained delegation abuse. The rule is designed to detect the following scripts > printerbug.py, dementor.py, SpoolSample.exe and Get-SpoolStatus.ps1.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1557.001 Adversary-in-the-Middle: Name Resolution Poisoning and SMB Relay |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
Rule body yaml
title: Discovery for print spooler bug abuse (NTLM hash retrivial) via named pipe
description: Detects scenarios where an attacker with a responder in place initiates an authenticated callback request from a targeted host with the print spooler service enabled (RpcRemoteFindFirstPrinterChangeNotification abuse). In case the targeted host answers to the responder, the NTLM hash of the computer account will be disclosed. Following that, the hash can be used for different type of abuse like Silver ticket generation or unconstrained delegation abuse. The rule is designed to detect the following scripts > printerbug.py, dementor.py, SpoolSample.exe and Get-SpoolStatus.ps1.
correlation: correlate SubjectLogonId + IpPort from ID 5145 with ID TargetLogonId + IpPort from 4624.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1557-Man%20in%20the%20middle
- https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py
- https://github.com/NotMedic/NetNTLMtoSilverTicket?s=09
- https://github.com/leechristensen/SpoolSample/
- https://github.com/vletoux/SpoolerScanner
- https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
- https://book.hacktricks.xyz/windows/active-directory-methodology/printers-spooler-service-abuse
- https://stealthbits.com/blog/impersonating-service-accounts-with-silver-tickets/
- https://blog.cymulate.com/compromising-a-domain
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/b8b414d9-f1cd-4191-bb6b-87d09ab2fd83
tags:
- attack.credential_access
- attack.t1557.001
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5145
ShareName: '\\*\IPC$'
RelativeTargetName: spoolss
AccessMask:
- 0x3 # printerbug.py, dementor.py
- 0x12019F # Get-SpoolStatus.ps1
condition: selection | count(Computer) by IpAddress > 20
falsepositives:
- vulnerability scanners
level: high
Stages and Predicates
Stage 0: condition
selection | count(Computer) by IpAddress > 20Stage 1: selection
selection:
EventID: 5145
ShareName: '\\*\IPC$'
RelativeTargetName: spoolss
AccessMask:
- 0x3
- 0x12019F
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
AccessMask | eq |
|
RelativeTargetName | eq |
|
ShareName | wildcard |
|