Potential PrintNightmare Exploitation Attempt (CVE-2021-1675)

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•1•0•26

This rule detects attempts to exploit the PrintNightmare vulnerability (CVE-2021-1675) by monitoring for DLL deletions within the Windows Spooler Service driver folder. Specifically, it looks for `spoolsv.exe` deleting files in `C:\Windows\System32\spool\drivers\x64\3\`, which is a common indicator of this exploit.