Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

stablecritical
Log-Quelle: antivirusAutor Sittikorn S, Nuttakorn T, Tim SheltonDatum 2021-07-01
01

Beschreibung

Was dies ist, in Kürze.

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

02

Tags

attack.privilege-escalationattack.stealthattack.t1055detection.emerging-threatscve.2021-34527cve.2021-1675
03

Regelquelle (YAML)

title: Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection
id: 6fe1719e-ecdf-4caf-bffe-4f501cb0a561
status: stable
description: Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .
references:
    - https://twitter.com/mvelazco/status/1410291741241102338
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
author: Sittikorn S, Nuttakorn T, Tim Shelton
date: 2021-07-01
modified: 2023-10-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - detection.emerging-threats
    - cve.2021-34527
    - cve.2021-1675
logsource:
    category: antivirus
detection:
    selection:
        Filename|contains: ':\Windows\System32\spool\drivers\x64\'
    keywords:
        - 'File submitted to Symantec' # symantec fp, pending analysis, more generic
    condition: selection and not keywords
falsepositives:
    - Unlikely, or pending PSP analysis
level: critical
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.