Rule Library

Sigma Rules

Browse detections by severity and log source, with YAML and sample events one click away.

3,782Total

3,164Detection

474Emerging

141Hunting

Filters

Type

Severity

Status

Product

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Generalantivirus

2023-10-23

hightestEmerging Threat

Potential PrintNightmare Exploitation Attempt

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

windowsfile_delete

2023-02-17

criticaltestEmerging Threat

CVE-2021-1675 Print Spooler Exploitation Filename Pattern

Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

windowsfile_event

2022-12-25

informationaltestEmerging Threat

Windows Spooler Service Suspicious Binary Load

Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).

windowsimage_load

2022-06-02

criticaltestEmerging Threat

PrinterNightmare Mimikatz Driver Name

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

windowsregistry_event

2023-06-12

‹1 2 ›