CVE-2021-1675 Print Spooler Exploitation IPC Access

Description

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

Query · sigma

selection:
  EventID: 5145
  ShareName: \\\\\*\\IPC$
  RelativeTargetName: spoolss
  AccessMask: '0x3'
  ObjectType: File
condition: selection

Known false positives

  • Unknown
Raw source CVE-2021-1675 Print Spooler Exploitation IPC Access · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: CVE-2021-1675 Print Spooler Exploitation IPC Access
id: 8fe1c584-ee61-444b-be21-e9054b229694
status: test
description: Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527
references:
    - https://twitter.com/INIT_3/status/1410662463641731075
author: INIT_6
date: 2021-07-02
modified: 2022-10-05
tags:
    - attack.execution
    - attack.t1569
    - cve.2021-1675
    - cve.2021-34527
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName: '\\\\\*\\IPC$' # looking for the string \\*\IPC$
        RelativeTargetName: 'spoolss'
        AccessMask: '0x3'
        ObjectType: 'File'
    condition: selection
falsepositives:
    - Unknown
level: critical

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.