fix: wrong temp rule in folder

This commit is contained in:
Florian Roth
2022-08-17 09:28:21 +02:00
parent eeeae44db5
commit c5f4dbacd8
@@ -1,45 +0,0 @@
title: Possible CVE-2021-1675 Print Spooler Exploitation
id: e98974e6-591e-47f5-bd32-61d6272da6b4
description: Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675
author: Florian Roth, KevTheHermit, fuzzyf10w, Tim Shelton
status: experimental
level: high
references:
- https://github.com/hhlxf/PrintNightmare
- https://github.com/afwu/PrintNightmare
- https://twitter.com/fuzzyf10w/status/1410202370835898371
date: 2021/06/30
modified: 2022/06/22
tags:
- attack.execution
- attack.t1569
- cve.2021.1675
logsource:
product: windows
service: printservice-admin
detection:
selection:
EventID:
- 808 # old id
- 4909 # new id
ErrorCode:
- '0x45A'
- '0x7e'
keywords:
- 'The print spooler failed to load a plug-in module'
# default file names used in PoC codes
- 'MyExploit.dll'
- 'evil.dll'
- '\addCube.dll'
- '\rev.dll'
- '\rev2.dll'
- '\main64.dll'
- '\mimilib.dll'
- '\mimispool.dll'
falsepositive:
- ' registration timed out' # ex: The print spooler failed to load a plug-in module PrintConfig registration timed out
condition: (selection or keywords) and not falsepositive
fields:
- PluginDllName
falsepositives:
- Problems with printer drivers