title: CVE-2021-1675 Print Spooler Exploitation IPC Access
id: 8fe1c584-ee61-444b-be21-e9054b229694
description: Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527
author: INIT_6
status: experimental
level: critical
references:
    - https://twitter.com/INIT_3/status/1410662463641731075
    - https://nvd.nist.gov/vuln/detail/cve-2021-1675
    - https://nvd.nist.gov/vuln/detail/cve-2021-34527
date: 2021/07/02
tags:
    - attack.execution
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: '5145'
        ShareName: '\\\*\IPC$'
        RelativeTargetName: 'spoolss'
        AccessMask: '0x3'
        ObjectType: 'File'
    condition: selection
falsepositives:
    - nothing observed so far
