Print spooler privilege escalation via printer added (CVE-2020-1048)

Status: experimental
Severity: high
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: Emir Erdogan (shortly adapted by mdecrevoisier)
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker abuse the printer spooler features to load a DLL. The attack is composed by 4 steps > 1) create a printer that points to a missing DLL 2) print to that port 3) crash the printer spool 4) have his original DLL registered for privilege escalation.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1547.010` Boot or Logon Autostart Execution: Port Monitors

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule body

title: Print spooler privilege escalation via printer added (CVE-2020-1048)
description: Detects scenarios where an attacker abuse the printer spooler features to load a DLL. The attack is composed by 4 steps > 1) create a printer that points to a missing DLL 2) print to that port 3) crash the printer spool 4) have his original DLL registered for privilege escalation.
reference:
- https://twitter.com/aionescu/status/1260466215299973121
- https://windows-internals.com/printdemon-cve-2020-1048/
tags:
- attack.privilege_escalation
- attack.t1547.010
author: Emir Erdogan (shortly adapted by mdecrevoisier)
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command "Add-PrinterPort -Name c:\windows\system32\\*.exe'"
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - Add-PrinterPort
      - Name
    EventData|contains:
      - .exe
      - .dll

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - Add-PrinterPort
      - Name
    Payload|contains:
      - .exe
      - .dll

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - Add-PrinterPort
      - Name
    ScriptBlockText|contains:
      - .exe
      - .dll

  condition: selection_powershell_native or selection_powershell_modern or selection_powershell_block
falsepositives:
- unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_powershell_native or selection_powershell_modern or selection_powershell_block

Stage 1: `selection_powershell_native`

selection_powershell_native:
  EventID: 800
  EventData|contains|all:
    - Add-PrinterPort
    - Name
  EventData|contains:
    - .exe
    - .dll

Stage 2: `selection_powershell_modern`

selection_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - Add-PrinterPort
    - Name
  Payload|contains:
    - .exe
    - .dll

Stage 3: `selection_powershell_block`

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - Add-PrinterPort
    - Name
  ScriptBlockText|contains:
    - .exe
    - .dll

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`.dll` corpus 3 (sigma 3) `.exe` `Add-PrinterPort` `Name` corpus 3 (sigma 3)	`field:"EventData" kind:match`
`Payload`	match	`.dll` corpus 3 (sigma 3) `.exe` `Add-PrinterPort` `Name` corpus 3 (sigma 3)	`field:"Payload" kind:match`
`ScriptBlockText`	match	`.dll` corpus 3 (sigma 3) `.exe` `Add-PrinterPort` `Name` corpus 4 (sigma 4)	`field:"ScriptBlockText" kind:match`