Potential PrintNightmare Exploit Registry Modification

Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to CVE-2021-34527 and verify that the impacted system is investigated.

Rule type: eql
Rule indices:

• logs-endpoint.events.*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
• https://github.com/afwu/PrintNightmare

Tags:

• Elastic
• Host
• Windows
• Threat Detection
• Privilege Escalation

Version: 100
Rule authors:

• Elastic

Rule license: Elastic License v2

/* This rule is not compatible with Sysmon due to schema issues */

registry where process.name : "spoolsv.exe" and
  (registry.path : "HKLM\\SYSTEM\\ControlSet*\\Control\\Print\\Environments\\Windows*\\Drivers\\Version-3\\mimikatz*\\Data File" or
  (registry.path : "HKLM\\SYSTEM\\ControlSet*\\Control\\Print\\Environments\\Windows*\\Drivers\\Version-3\\*\\Configuration File" and
   registry.data.strings : ("kernelbase.dll", "ntdll.dll", "kernel32.dll", "winhttp.dll", "user32.dll")))
		

Framework: MITRE ATT&CK

• Tactic:

  • Name: Privilege Escalation
  • Id: TA0004
  • Reference URL: https://attack.mitre.org/tactics/TA0004/

• Technique:

  • Name: Exploitation for Privilege Escalation
  • Id: T1068
  • Reference URL: https://attack.mitre.org/techniques/T1068/