printnightmare-cve-2021-1675 usage detection (1)

id: ec1e131a-79cb-4f5c-b5e6-3edc5574ac68
name: printnightmare-cve-2021-1675 usage detection (1)
description: |
  First query digs in print spooler drivers folder for any file creations,
  MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
  or ones that don't have any relations to printers that you are using are
  suspicious.
  Second query that can be used for finding client machines that
  could be operating print servers or file servers is also included here.
  As additional mitigation for the exploit you might want to block the
  incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
  spooler service running to print from clients.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics:
- Privilege escalation
- Lateral movement
- Exploit
query: |
  DeviceNetworkEvents
  | where Timestamp > ago(7d)
  | where LocalPort == 445
  | summarize RemoteIPCount=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessId, InitiatingProcessCreationTime