PrintNightmare exploited in the wild, patch now
A critical Windows Print Spooler vulnerability (CVE-2021-34527), known as PrintNightmare, is being actively exploited, and Microsoft has released patches and workarounds.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-34527 as exploited in the wild.
IPA (Japan's Information-technology Promotion Agency) issued an alert on CVE-2021-34527, a remote code execution vulnerability in the Windows Print Spooler service, publicly disclosed on July 1, 2021. Microsoft confirmed that exploitation of this vulnerability, dubbed PrintNightmare, has been observed in the wild, allowing attackers to execute arbitrary code with SYSTEM privileges on affected Windows systems.
Microsoft released patches for many affected products, though as of July 7, 2021, fixes were not yet available for all impacted Windows versions. IPA recommended organizations apply available patches immediately via Windows Update and, for unpatched systems, implement Microsoft's recommended workarounds and mitigations, such as disabling the Print Spooler service or restricting inbound remote printing through Group Policy. Given the broad deployment of Windows and confirmed active exploitation, this vulnerability posed a significant and urgent risk to organizations pending full patch availability.
Mentioned in this report
Detection guidance
Suspicious Remote Procedure Call to Print Spooler Service
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects RPC calls to the Print Spooler service (spoolsv.exe) from remote callers, indicative of PrintNightmare exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Remote Procedure Call to Print Spooler Service
description: Detects inbound RPC connections to the Print Spooler service (spoolsv.exe)
from remote network sources. PrintNightmare exploits use RPC to trigger vulnerable
code paths in the spooler.
tags:
- attack.t1210
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \spoolsv.exe
DestinationPort:
- 135
- 139
- 445
filter_local:
SourceIp:
- 127.0.0.1
- ::1
- 169.254.169.254
condition: selection and not filter_local
falsepositives:
- Legitimate remote print server connections from other hosts on the network
- Print administration tools initiating RPC calls to manage spoolers
level: high
id: 841090ef-699a-5ab8-a96c-3d966906f862
status: experimental
author: Vorant
Print Spooler Service Loading Suspicious DLL from Network Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects spoolsv.exe loading DLLs from UNC paths or unexpected locations, a key PrintNightmare exploitation indicator. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Print Spooler Service Loading Suspicious DLL from Network Path
description: Detects the Print Spooler service (spoolsv.exe) loading DLL files from
UNC network paths or unusual directories. PrintNightmare exploits trigger loading
of attacker-controlled DLLs via AddPrinterDriver RPC calls.
tags:
- attack.t1210
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \spoolsv.exe
ImageLoaded|contains:
- \\\\
- \\\?
filter_known_paths:
ImageLoaded|contains:
- System32
- SysWOW64
condition: selection and not filter_known_paths
falsepositives:
- Print drivers distributed from network shares in enterprise environments
- Print server configurations using network-based driver repositories
level: high
id: c100e3c7-eb45-5a10-b7ba-52ded815cbc0
status: experimental
author: Vorant
Print Spooler Service Spawning Unexpected Child Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects spoolsv.exe creating child processes, indicating code execution via PrintNightmare exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Print Spooler Service Spawning Unexpected Child Process
description: Detects the Print Spooler service (spoolsv.exe) spawning child processes.
Successful PrintNightmare exploitation typically results in arbitrary code execution
under SYSTEM context, manifested as child process creation from the spooler.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \spoolsv.exe
filter_known_children:
Image|endswith:
- \rundll32.exe
- \svchost.exe
- \werfault.exe
condition: selection and not filter_known_children
falsepositives:
- Print driver installation utilities spawned by the spooler during normal operation
- Windows Update or maintenance tasks triggered by spooler service
level: high
id: fff8552c-280f-5ec0-bcfc-6a7f434f60b1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210705-ms.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs