Detection rules › Splunk
Rare dll called by Spoolsv.exe (Windows Event Log)
Spooler service has been known to have several vulnerabilities most recently CVE-2021-1675 AKA Print Nightmare and CVE-2021-34527. This use case looks for rare dll calls from spoolsv.exe. NOTE file auditing on C:\Windows\System32\spool\drivers must be enabled and Windows global object access policy may need to be configured to capture 4663 events
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1547.010 Boot or Logon Autostart Execution: Port Monitors |
| Privilege Escalation | T1547.010 Boot or Logon Autostart Execution: Port Monitors |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4663 | An attempt was made to access an object. |
Rule body yaml
id: '6447.7207'
title: Rare dll called by Spoolsv.exe
description: 'Spooler service has been known to have several vulnerabilities most
recently CVE-2021-1675 AKA Print Nightmare and CVE-2021-34527. This use case looks
for rare dll calls from spoolsv.exe. NOTE file auditing on C:\Windows\System32\spool\drivers
must be enabled and Windows global object access policy may need to be configured
to capture 4663 events. -- Threat Actor Association: Vice Society - Software Association:
Black Basta, Lockbit, Play, Ransom Cartel, Vice Society'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
"<EventID>4663<") TERM("C:\\Windows\\System32\\spool\\drivers\\*") TERM("C:\\Windows\\System32\\spoolsv.exe")
"dll" | eval file_path=Object_Name| rex max_match=0 "(?<driver>\S+\.dll)" | rex
field=driver "\\\(?<file_name>[^\\\]+\.dll)"| fields _time, host, user, signature_id,
process, process_*, parent_*, signature, file_path, parameters, file_name `group_events("host,
process_name, file_name", 5)` | eventstats c(file_name) as c_file_name dc(host)
as dc_host by file_name | where c_file_name <= 5 AND dc_host=1 '
techniques:
- persistence:boot or logon autostart execution
- persistence:boot or logon autostart execution:port monitors
- privilege-escalation:boot or logon autostart execution:port monitors
technique_id:
- T1547
- T1547.010
data_category:
- Windows event logs
references:
- https://github.com/calebstewart/CVE-2021-1675
- https://github.com/afwu/PrintNightmare
- https://github.com/JohnHammond/CVE-2021-34527
- https://docs.microsoft.com/en-us/windows-server/identity/solution-guides/deploy-security-auditing-with-central-audit-policies--demonstration-steps-
Stages and Predicates
Stage 1: search
search EventCode=4663 source="*" source IN ("WinEventLog:Security", "XmlWinEventLog:Security")
Stage 2: eval
eval file_path = ({ uses: Object_Name })
Stage 3: rex
rex ...
Stage 4: rex
rex field=driver ... -> file_name
Stage 5: fields
fields _time, file_name, file_path, host, parameters, parent_*, process, process_*, signature, signature_id, user
Stage 6: bucket
bucket _time
Stage 7: stats
stats BY host, process_name, file_name, _time
Stage 8: eventstats
eventstats … AS c_file_name, … AS dc_host BY file_name
Stage 9: where
where c_file_name<=5 dc_host=1
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
c_file_name | le |
|
dc_host | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4663<" |
| 1 | "\" |
| 1 | C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\*\"" |
| 1 | "\" |
| 1 | C:\\\\Windows\\\\System32\\\\spoolsv.exe\"" |
| 1 | "dll" |