Emerging Threathightest

CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

EagleEye Team, Florian Roth (Nextron Systems), NVISOCreated Wed May 13Updated Mon Mar 257ec912f2-5175-4868-b811-ec13ad0f85672020

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows NT\CurrentVersion\Ports'
        Details|contains:
            - '.bat'
            - '.com'
            - '.dll'
            - '.exe'
            - '.ps1'
            - '.vbe'
            - '.vbs'
            - 'C:'
    condition: selection