Emerging Threatcriticalstable

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Sittikorn S, Nuttakorn T, Tim SheltonCreated Thu Jul 01Updated Mon Oct 236fe1719e-ecdf-4caf-bffe-4f501cb0a5612021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Antivirus Alert

CategoryAntivirus Alert← raw: antivirus

Detection Logic

detection:
    selection:
        Filename|contains: ':\Windows\System32\spool\drivers\x64\'
    keywords:
        - 'File submitted to Symantec' # symantec fp, pending analysis, more generic
    condition: selection and not keywords

False Positives

Unlikely, or pending PSP analysis

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0004 · Privilege Escalation