title: Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection
id: 6fe1719e-ecdf-4caf-bffe-4f501cb0a561
status: stable
description: Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .
references:
    - https://twitter.com/mvelazco/status/1410291741241102338
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
author: Sittikorn S, Nuttakorn T, Tim Shelton
date: 2021/07/01
modified: 2022/03/15
tags:
    - attack.privilege_escalation
    - attack.t1055
logsource:
    product: antivirus
detection:
    selection:
        Filename|contains: 'C:\Windows\System32\spool\drivers\x64\'
    keywords:
        - 'File submitted to Symantec for analysis' # symantec fp, pending analysis
    condition: selection and not keywords
fields:
    - Signature
    - Filename
    - ComputerName
falsepositives:
    - Unlikely, or pending PSP analysis
level: critical
