PrintNightmare exploited in the wild, patch now
A critical Windows Print Spooler vulnerability (CVE-2021-34527), known as PrintNightmare, is being actively exploited, and Microsoft has released patches and workarounds.
IPA (Japan's Information-technology Promotion Agency) issued an alert on CVE-2021-34527, a remote code execution vulnerability in the Windows Print Spooler service, publicly disclosed on July 1, 2021. Microsoft confirmed that exploitation of this vulnerability, dubbed PrintNightmare, has been observed in the wild, allowing attackers to execute arbitrary code with SYSTEM privileges on affected Windows systems.
Microsoft released patches for many affected products, though as of July 7, 2021, fixes were not yet available for all impacted Windows versions. IPA recommended organizations apply available patches immediately via Windows Update and, for unpatched systems, implement Microsoft's recommended workarounds and mitigations, such as disabling the Print Spooler service or restricting inbound remote printing through Group Policy. Given the broad deployment of Windows and confirmed active exploitation, this vulnerability posed a significant and urgent risk to organizations pending full patch availability.
Mentioned in this report
Detection guidance
Suspicious Remote Procedure Call to Print Spooler Service
Detects RPC calls to the Print Spooler service (spoolsv.exe) from remote callers, indicative of PrintNightmare exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Remote Procedure Call to Print Spooler Service
description: Detects inbound RPC connections to the Print Spooler service (spoolsv.exe)
from remote network sources. PrintNightmare exploits use RPC to trigger vulnerable
code paths in the spooler.
tags:
- attack.t1210
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith: \spoolsv.exe
DestinationPort:
- 135
- 139
- 445
filter_local:
SourceIp:
- 127.0.0.1
- ::1
- 169.254.169.254
condition: selection and not filter_local
falsepositives:
- Legitimate remote print server connections from other hosts on the network
- Print administration tools initiating RPC calls to manage spoolers
level: high
id: 841090ef-699a-5ab8-a96c-3d966906f862
status: experimental
author: Vorant
Print Spooler Service Loading Suspicious DLL from Network Path
Detects spoolsv.exe loading DLLs from UNC paths or unexpected locations, a key PrintNightmare exploitation indicator. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Print Spooler Service Loading Suspicious DLL from Network Path
description: Detects the Print Spooler service (spoolsv.exe) loading DLL files from
UNC network paths or unusual directories. PrintNightmare exploits trigger loading
of attacker-controlled DLLs via AddPrinterDriver RPC calls.
tags:
- attack.t1210
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \spoolsv.exe
ImageLoaded|contains:
- \\\\
- \\\?
filter_known_paths:
ImageLoaded|contains:
- System32
- SysWOW64
condition: selection and not filter_known_paths
falsepositives:
- Print drivers distributed from network shares in enterprise environments
- Print server configurations using network-based driver repositories
level: high
id: c100e3c7-eb45-5a10-b7ba-52ded815cbc0
status: experimental
author: Vorant
Print Spooler Service Spawning Unexpected Child Process
Detects spoolsv.exe creating child processes, indicating code execution via PrintNightmare exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Print Spooler Service Spawning Unexpected Child Process
description: Detects the Print Spooler service (spoolsv.exe) spawning child processes.
Successful PrintNightmare exploitation typically results in arbitrary code execution
under SYSTEM context, manifested as child process creation from the spooler.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \spoolsv.exe
filter_known_children:
Image|endswith:
- \rundll32.exe
- \svchost.exe
- \werfault.exe
condition: selection and not filter_known_children
falsepositives:
- Print driver installation utilities spawned by the spooler during normal operation
- Windows Update or maintenance tasks triggered by spooler service
level: high
id: fff8552c-280f-5ec0-bcfc-6a7f434f60b1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/20210705-ms.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free