PrintNightmare exploited in the wild, patch now

6 July 2021 critical vulnerability

A actively-exploited Windows Print Spooler vulnerability (CVE-2021-34527, aka PrintNightmare) allows remote code execution; Microsoft has released patches and workarounds.

IPA Japan issued an alert regarding CVE-2021-34527, a remote code execution vulnerability in Windows Print Spooler service known as PrintNightmare. Microsoft confirmed active exploitation of the flaw in the wild, which allows an attacker to execute arbitrary code with SYSTEM privileges on affected Windows systems.

Microsoft released patches for many affected Windows versions, though as of the alert's July 7, 2021 update, some products had not yet received fixes. IPA urges organizations to apply available patches immediately and, where patches are unavailable, to implement Microsoft's recommended workarounds and mitigations, such as disabling the Print Spooler service or restricting inbound remote printing through Group Policy.

Given the confirmed in-the-wild exploitation and the widespread deployment of the affected Windows Print Spooler service across enterprise environments, this vulnerability poses a significant risk until patched or mitigated.

Mentioned in this report

Vulnerabilities CVE-2021-34527KEV

Detection guidance

Suspicious Child Process Spawned by Print Spooler Service (PrintNightmare)

ATT&CK T1068

Detects spoolsv.exe spawning command interpreters or unusual binaries, consistent with PrintNightmare (CVE-2021-34527) exploitation for SYSTEM code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Print Spooler Service
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \spoolsv.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
  filter:
    Image|endswith: \splwow64.exe
  condition: selection and not filter
  fields:
  - Image
  - CommandLine
  - ParentImage
  falsepositives:
  - Legitimate print driver installation utilities that spawn helper processes
  - Some third-party printer management software may launch scripts from the spooler
  level: high
  tags:
  - attack.t1068
  - attack.t1210
  - cve.2021-34527
id: 8daa9b0b-3d89-5e6f-b442-fab24a7f554d
status: experimental
author: Vorant

DLL Written or Loaded from Print Spooler Driver Directory

ATT&CK T1068

Detects creation or loading of a DLL from the Print Spooler driver directory structure, a hallmark of PrintNightmare payload delivery via malicious print driver installation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: DLL Dropped or Loaded in Spooler Driver Directory
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: \spool\drivers\
    ImageLoaded|endswith: .dll
  filter:
    ImageLoaded|contains:
    - \spool\drivers\x64\3\PCC
    - \spool\drivers\color\
  condition: selection and not filter
  fields:
  - Image
  - ImageLoaded
  falsepositives:
  - Legitimate print driver installation from vendor packages placing DLLs in the
    same directory
  - Windows Update driver package staging
  level: medium
  tags:
  - attack.t1068
  - attack.t1210
  - cve.2021-34527
id: 77f26a23-530b-5be3-8642-8e4278281546
status: experimental
author: Vorant

Remote Print Driver Installation via RPC to Spooler Service

ATT&CK T1210

Detects inbound network connections to the Print Spooler RPC endpoint (port 445/135) followed by new file creation in spool driver directories, indicative of remote PrintNightmare exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: New Executable File Created in Print Spooler Driver Path
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: \spool\drivers\x64\3\
    TargetFilename|endswith:
    - .dll
    - .exe
  filter:
    Image|endswith: \spoolsv.exe
    TargetFilename|contains: \spool\drivers\x64\3\PCC
  condition: selection and not filter
  fields:
  - TargetFilename
  - Image
  - ProcessGuid
  falsepositives:
  - Authorized administrator installing a new print driver package
  - Legitimate printer driver updates pushed via management tools
  level: medium
  tags:
  - attack.t1210
  - attack.t1068
  - cve.2021-34527
id: b6a2715a-747f-5878-a256-b907135e8030
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210705-ms.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free