DCERPC SMB Spoolss Named Pipe

Status: test
Severity: medium
Log source: product windows, service security
Author: OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Known false positives

Domain Controllers acting as printer servers too? :)

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: DCERPC SMB Spoolss Named Pipe
id: 214e8f95-100a-4e04-bb31-ef6cba8ce07e
status: test
description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
references:
    - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
    - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
    - https://twitter.com/_dirkjan/status/1309214379003588608
author: OTR (Open Threat Research)
date: 2018-11-28
modified: 2022-08-11
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName: '\\\\\*\\IPC$' # looking for the string \\*\IPC$
        RelativeTargetName: spoolss
    condition: selection
falsepositives:
    - 'Domain Controllers acting as printer servers too? :)'
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 5145
    ShareName: '\\\\\*\\IPC$'
    RelativeTargetName: spoolss

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`RelativeTargetName`	eq	`spoolss` corpus 3 (sigma 3)	`field:"RelativeTargetName" kind:eq value:"spoolss"`
`ShareName`	eq	`\\\\\*\\IPC$` corpus 7 (sigma 7)	`field:"ShareName" kind:eq value:"\\\\\*\\IPC$"`