fix: wrong temp rule in folder
This commit is contained in:
-45
@@ -1,45 +0,0 @@
|
||||
title: Possible CVE-2021-1675 Print Spooler Exploitation
|
||||
id: e98974e6-591e-47f5-bd32-61d6272da6b4
|
||||
description: Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675
|
||||
author: Florian Roth, KevTheHermit, fuzzyf10w, Tim Shelton
|
||||
status: experimental
|
||||
level: high
|
||||
references:
|
||||
- https://github.com/hhlxf/PrintNightmare
|
||||
- https://github.com/afwu/PrintNightmare
|
||||
- https://twitter.com/fuzzyf10w/status/1410202370835898371
|
||||
date: 2021/06/30
|
||||
modified: 2022/06/22
|
||||
tags:
|
||||
- attack.execution
|
||||
- attack.t1569
|
||||
- cve.2021.1675
|
||||
logsource:
|
||||
product: windows
|
||||
service: printservice-admin
|
||||
detection:
|
||||
selection:
|
||||
EventID:
|
||||
- 808 # old id
|
||||
- 4909 # new id
|
||||
ErrorCode:
|
||||
- '0x45A'
|
||||
- '0x7e'
|
||||
keywords:
|
||||
- 'The print spooler failed to load a plug-in module'
|
||||
# default file names used in PoC codes
|
||||
- 'MyExploit.dll'
|
||||
- 'evil.dll'
|
||||
- '\addCube.dll'
|
||||
- '\rev.dll'
|
||||
- '\rev2.dll'
|
||||
- '\main64.dll'
|
||||
- '\mimilib.dll'
|
||||
- '\mimispool.dll'
|
||||
falsepositive:
|
||||
- ' registration timed out' # ex: The print spooler failed to load a plug-in module PrintConfig registration timed out
|
||||
condition: (selection or keywords) and not falsepositive
|
||||
fields:
|
||||
- PluginDllName
|
||||
falsepositives:
|
||||
- Problems with printer drivers
|
||||
Reference in New Issue
Block a user