Emerging Threatinformationaltest

Windows Spooler Service Suspicious Binary Load

Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

FPT.EagleEye, Thomas PatzkeCreated Tue Jun 29Updated Thu Jun 0202fb90de-c321-4e63-a6b9-25f4b03dfd142021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    selection:
        Image|endswith: '\spoolsv.exe'
        ImageLoaded|contains:
            - '\Windows\System32\spool\drivers\x64\3\'
            - '\Windows\System32\spool\drivers\x64\4\'
        ImageLoaded|endswith: '.dll'
    condition: selection