SigmaHQ/rules/windows/sysmon/sysmon_cve-2020-1048.yml

action: global
title: Suspicious PrinterPorts Created (CVE-2020-1048)
id: 7ec912f2-5175-4868-b811-ec13ad0f8567
status: experimental
description: Detects new registry printer port was created or powershell command add new printer port which point to suspicious file
author: EagleEye Team, Florian Roth
date: 2020/05/13
modified: 2020/05/15
references:
    - https://windows-internals.com/printdemon-cve-2020-1048/
tags:
    - attack.persistence
    - attack.execution
falsepositives:
    - New printer port install on host
level: high
---
logsource:
    service: sysmon
    product: windows
detection:        
    selection: 
        EventID: 
            - 12
            - 13 
        TargetObject|startswith: 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports'
        EventType:
            - SetValue
            - DeleteValue
            - CreateValue
        TargetObject|contains:
            - '.dll'
            - '.exe'
            - 'C:'
    condition: selection
---
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains: 'Add-PrinterPort -Name'
    selection2:
        CommandLine|contains:
            - '.dll'
            - '.exe'
    condition: selection1 and selection2