title: CVE-2021-1675 Print Spooler Exploitation Filename Pattern
id: 2131cfb3-8c12-45e8-8fa0-31f5924e9f07
description: Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675
author: Florian Roth
status: experimental
level: critical
references:
    - https://github.com/hhlxf/PrintNightmare
    - https://github.com/afwu/PrintNightmare
    - https://github.com/cube0x0/CVE-2021-1675
    - https://nvd.nist.gov/vuln/detail/cve-2021-1675
date: 2021/06/29
modified: 2021/07/01
tags:
    - attack.execution
    - attack.privilege_escalation
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 
        - 'C:\Windows\System32\spool\drivers\x64\3\old\1\123'
        - 'C:\Windows\System32\spool\drivers\x64\3\New\'
    condition: selection
fields:
    - ComputerName
    - TargetFilename
falsepositives:
    - Unknown
