printnightmare-cve-2021-1675 usage detection

id: ec1934d5-c591-4ff4-9968-079dba04d28e
name: printnightmare-cve-2021-1675 usage detection
description: |
  First query digs in print spooler drivers folder for any file creations,
  MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
  or ones that don't have any relations to printers that you are using are
  suspicious.
  Second query that can be used for finding client machines that
  could be operating print servers or file servers is also included here.
  As additional mitigation for the exploit you might want to block the
  incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
  spooler service running to print from clients.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Privilege escalation
- Lateral movement
- Exploit
query: |
  DeviceFileEvents
  | where Timestamp > ago(7d)
  | where ActionType == "FileCreated"
  | where FolderPath startswith "C:\\WINDOWS\\SYSTEM32\\SPOOL\\drivers"