valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 02:08:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1593 from hieuttmmo/master

Browse Source 
PrintNightmare Detection using ImageLoad
This commit is contained in:
Florian Roth 2021-06-30 16:10:19 +02:00 committed by GitHub
commit cb63816dcc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml Normal file
View File

@ -0,0 +1,27 @@
title: Windows Spooler Service Suspicious Binary Load
id: 02fb90de-c321-4e63-a6b9-25f4b03dfd14
status: experimental
description: Detect suspicious DLL Load from Spooler Service backup folder
references:
- https://github.com/hhlxf/PrintNightmare
author: FPT.EagleEye
date: 2021/06/29
tags:
- attack.persistence
- attack.defense_evasion
- attack.privilege_escalation
- attack.t1574
- cve.2021-1675
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith:
- 'spoolsv.exe'
ImageLoaded:
- 'Windows\System32\spool\drivers\x64\3\old\*.dll'
condition: selection
falsepositives:
- Possible. Requires further testing.
level: high