Added new possible ErrorCode

2021-07-02 07:27:00 -05:00
parent 203e6cf7b2
commit 527a3cb8cd
1 changed files with 5 additions and 3 deletions
@@ -17,11 +17,13 @@ logsource:
    service: printservice-admin
 detection:
    selection:
-        EventID: 
+        EventID:
            - 808   # old id
            - 4909  # new id
-        ErrorCode: '0x45A'
-    keywords: 
+        ErrorCode:
+            - '0x45A'
+            - '0x7e'
+    keywords:
        - 'The print spooler failed to load a plug-in module'
        # default file names used in PoC codes
        - 'MyExploit.dll'