PrinterNightmare Mimikatz Driver Name

Description

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Query · sigma

selection:
  TargetObject|contains:
  - \Control\Print\Environments\Windows x64\Drivers\Version-3\QMS 810\
  - \Control\Print\Environments\Windows x64\Drivers\Version-3\mimikatz
selection_alt:
  TargetObject|contains|all:
  - legitprinter
  - \Control\Print\Environments\Windows
selection_print:
  TargetObject|contains:
  - \Control\Print\Environments
  - \CurrentVersion\Print\Printers
selection_kiwi:
  TargetObject|contains:
  - Gentil Kiwi
  - mimikatz printer
  - Kiwi Legit Printer
condition: selection or selection_alt or (selection_print and selection_kiwi)

Known false positives

  • Legitimate installation of printer driver QMS 810, Texas Instruments microLaser printer (unlikely)
Raw source PrinterNightmare Mimikatz Driver Name · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: PrinterNightmare Mimikatz Driver Name
id: ba6b9e43-1d45-4d3c-a504-1043a64c8469
status: test
description: Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
references:
    - https://github.com/gentilkiwi/mimikatz/commit/c21276072b3f2a47a21e215a46962a17d54b3760
    - https://www.lexjansen.com/sesug/1993/SESUG93035.pdf
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913
    - https://nvd.nist.gov/vuln/detail/cve-2021-1675
    - https://nvd.nist.gov/vuln/detail/cve-2021-34527
author: Markus Neis, @markus_neis, Florian Roth
date: 2021-07-04
modified: 2023-06-12
tags:
    - attack.execution
    - attack.t1204
    - cve.2021-1675
    - cve.2021-34527
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_event
detection:
    selection:
        TargetObject|contains:
            - '\Control\Print\Environments\Windows x64\Drivers\Version-3\QMS 810\'
            - '\Control\Print\Environments\Windows x64\Drivers\Version-3\mimikatz'
    selection_alt:
        TargetObject|contains|all:
            - 'legitprinter'
            - '\Control\Print\Environments\Windows'
    selection_print:
        TargetObject|contains:
            - '\Control\Print\Environments'
            - '\CurrentVersion\Print\Printers'
    selection_kiwi:
        TargetObject|contains:
            - 'Gentil Kiwi'
            - 'mimikatz printer'
            - 'Kiwi Legit Printer'
    condition: selection or selection_alt or (selection_print and selection_kiwi)
falsepositives:
    - Legitimate installation of printer driver QMS 810, Texas Instruments microLaser printer (unlikely)
level: critical

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.