deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: ProxyLogon Reset Virtual Directories Based On IIS Log
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: frack113
Date: 2021-08-10
ATT&CK techniques: T1190
Log source: /webserver

Description:
When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "sc-status": 200,
    "cs-uri-stem": "/ecp/DDI/DDIService.svc/SetObject",
    "cs-uri-query|contains|all": [
      "schema=Reset",
      "VirtualDirectory"
    ],
    "cs-username|endswith": "$"
  },
  "keywords": {
    "|all": [
      "POST",
      200,
      "/ecp/DDI/DDIService.svc/SetObject",
      "schema=Reset",
      "VirtualDirectory",
      "$"
    ]
  },
  "condition": "selection or keywords"
}

References:
  - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c
Sigma Detection Rule: CVE-2021-26858 Exchange Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-03-03
ATT&CK techniques: T1203
Log source: windows/file_event

Description:
Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking for
creation of non-standard files on disk by Exchange Server’s Unified Messaging service
which could indicate dropping web shells or other malicious content


Detection logic:
{
  "selection": {
    "Image|endswith": "UMWorkerProcess.exe"
  },
  "filter": {
    "TargetFilename|endswith": [
      "CacheCleanup.bin",
      ".txt",
      ".LOG",
      ".cfg",
      "cleanup.bin"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Sigma Detection Rule: Exchange ProxyShell Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Rich Warren
Date: 2021-08-07
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects URL patterns that could be found in ProxyShell exploitation attempts against Exchange servers (failed and successful)

Detection logic:
{
  "selection_1": {
    "sc-status": 401
  },
  "selection_1_auto": {
    "cs-uri-query|contains": "/autodiscover.json"
  },
  "selection_1_uri": {
    "cs-uri-query|contains": [
      "/powershell",
      "/mapi/nspi",
      "/EWS",
      "X-Rps-CAT"
    ]
  },
  "selection_poc": {
    "sc-status": 401,
    "cs-uri-query|contains": [
      "autodiscover.json?@",
      "autodiscover.json%3f@",
      "%3f@foo.com",
      "Email=autodiscover/autodiscover.json",
      "json?@foo.com"
    ]
  },
  "condition": "all of selection_1* or selection_poc"
}

References:
  - https://youtu.be/5mqid-7zp8k?t=2231
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
  - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
Sigma Detection Rule: Successful Exchange ProxyShell Attack
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Rich Warren
Date: 2021-08-09
Log source: /webserver

Description:
Detects URP patterns and status codes that indicate a successful ProxyShell exploitation attack against Exchange servers

Detection logic:
{
  "selection_auto": {
    "cs-uri-query|contains": "/autodiscover.json"
  },
  "selection_uri": {
    "cs-uri-query|contains": [
      "/powershell",
      "/mapi/nspi",
      "/EWS",
      "X-Rps-CAT"
    ]
  },
  "selection_success": {
    "sc-status": [
      200,
      301
    ]
  },
  "condition": "selection_auto and selection_uri and selection_success"
}

References:
  - https://youtu.be/5mqid-7zp8k?t=2231
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
  - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
Sigma Detection Rule: Serv-U Exploitation CVE-2021-35211 by DEV-0322
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-14
ATT&CK techniques: T1136.001
Log source: windows/process_creation

Description:
Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322

Detection logic:
{
  "selection_whoami": {
    "CommandLine|contains": "whoami"
  },
  "selection_cmd_1": {
    "CommandLine|contains": [
      "./Client/Common/",
      ".\\Client\\Common\\"
    ]
  },
  "selection_cmd_2": {
    "CommandLine|contains": "C:\\Windows\\Temp\\Serv-U.bat"
  },
  "condition": "selection_whoami and 1 of selection_cmd*"
}

References:
  - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
Sigma Detection Rule: CVE-2021-44077 POC Default Dropped File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-06
Log source: windows/file_event

Description:
Detects the creation of "msiexec.exe" in the "bin" directory of the ManageEngine SupportCenter Plus (Related to CVE-2021-44077) and public POC available (See references section)

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\ManageEngine\\SupportCenterPlus\\bin\\msiexec.exe"
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
  - https://github.com/horizon3ai/CVE-2021-44077/blob/b7a48e25824e8ead95e028475c7fd0e107e6e6bf/exploit.py
Sigma Detection Rule: Pulse Connect Secure RCE Attack CVE-2021-22893
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Sittikorn S
Date: 2021-06-29
ATT&CK techniques: T1190
Log source: /webserver

Description:
This rule detects exploitation attempts using Pulse Connect Secure(PCS) vulnerability (CVE-2021-22893)

Detection logic:
{
  "selection1": {
    "cs-uri-query|contains": [
      "/dana-na/auth/",
      "/dana-ws/",
      "/dana-cached/"
    ]
  },
  "selection2": {
    "cs-uri-query|contains": [
      "?id=",
      "?token=",
      "Secid_canceltoken.cgi",
      "CGI::param",
      "meeting",
      "smb",
      "namedusers",
      "metric"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html
  - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784
Sigma Detection Rule: Potential CVE-2021-27905 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @gott_cyber
Date: 2022-12-11
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Detection logic:
{
  "selection_request1": {
    "cs-uri-query|contains|all": [
      "/solr/",
      "/debug/dump?",
      "param=ContentStream"
    ],
    "sc-status": 200
  },
  "selection_request2": {
    "cs-method": "GET",
    "cs-uri-query|contains|all": [
      "/solr/",
      "command=fetchindex",
      "masterUrl="
    ],
    "sc-status": 200
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/Al1ex4/status/[PII_REDACTED]27128580
  - https://twitter.com/sec715/status/[PII_REDACTED]38362371
  - https://nsfocusglobal.com/apache-solr-arbitrary-file-read-and-ssrf-vulnerability-threat-alert/
  - https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=[PII_REDACTED]&idx=1&sn=2fdab8cbe4b873f8dd8abb35d935d186
  - https://github.com/murataydemir/CVE-2021-27905
Sigma Detection Rule: Potential Exploitation Attempt From Office Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems), @SBousseaden (idea)
Date: 2022-06-02
Log source: windows/process_creation

Description:
Detects Office applications executing a child process that includes directory traversal patterns. This could be an attempt to exploit CVE-2022-30190 (MSDT RCE) or CVE-2021-40444 (MSHTML RCE)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\winword.exe",
      "\\excel.exe",
      "\\powerpnt.exe",
      "\\msaccess.exe",
      "\\mspub.exe",
      "\\eqnedt32.exe",
      "\\visio.exe"
    ],
    "CommandLine|contains": [
      "../../../..",
      "..\\..\\..\\..",
      "..//..//..//.."
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]46301440
  - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-40444
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
Sigma Detection Rule: Suspicious Word Cab File Write CVE-2021-40444
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Sittikorn S
Date: 2021-09-10
ATT&CK techniques: T1587
Log source: windows/file_event

Description:
Detects file creation patterns noticeable during the exploitation of CVE-2021-40444

Detection logic:
{
  "selection_cab": {
    "Image|endswith": "\\winword.exe",
    "TargetFilename|contains": "\\Windows\\INetCache",
    "TargetFilename|endswith": ".cab"
  },
  "selection_inf": {
    "Image|endswith": "\\winword.exe",
    "TargetFilename|contains|all": [
      "\\AppData\\Local\\Temp\\",
      ".inf"
    ]
  },
  "filter_main_legit": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": "AppData\\Local\\Temp",
    "TargetFilename|endswith": "\\Content.inf"
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

References:
  - https://twitter.com/RonnyTNL/status/[PII_REDACTED]17373699?s=20
  - https://twitter.com/vanitasnk/status/[PII_REDACTED]42420483?s=21
Sigma Detection Rule: Potential CVE-2021-40444 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), @neonprimetime
Date: 2021-09-08
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

Detection logic:
{
  "selection": {
    "Image|endswith": "\\control.exe",
    "ParentImage|endswith": [
      "\\winword.exe",
      "\\powerpnt.exe",
      "\\excel.exe"
    ]
  },
  "filter": {
    "CommandLine|endswith": [
      "\\control.exe input.dll",
      "\\control.exe\" input.dll"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
  - https://twitter.com/neonprimetime/status/[PII_REDACTED]02255375
  - https://www.joesandbox.com/analysis/476188/1/iochtml
Sigma Detection Rule: LPE InstallerFileTakeOver PoC CVE-2021-41379
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-22
ATT&CK techniques: T1190
Log source: windows/

Description:
Detects PoC tool used to exploit LPE vulnerability CVE-2021-41379

Detection logic:
{
  "selection": {
    "EventID": 1033,
    "Provider_Name": "MsiInstaller",
    "Data|contains": "test pkg"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1949/https://github.com/klinix5/InstallerFileTakeOver
Sigma Detection Rule: Potential CVE-2021-41379 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-22
ATT&CK techniques: T1068
Log source: windows/process_creation

Description:
Detects potential exploitation attempts of CVE-2021-41379 (InstallerFileTakeOver), a local privilege escalation (LPE) vulnerability where the attacker spawns a "cmd.exe" process as a child of Microsoft Edge elevation service "elevation_service" with "LOCAL_SYSTEM" rights

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_parent": {
    "ParentImage|endswith": "\\elevation_service.exe",
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1949/https://github.com/klinix5/InstallerFileTakeOver
  - https://www.bleepingcomputer.com/news/microsoft/new-windows-zero-day-with-public-exploit-lets-you-become-an-admin/
  - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
  - https://www.logpoint.com/en/blog/detecting-privilege-escalation-zero-day-cve-2021-41379/
Sigma Detection Rule: InstallerFileTakeOver LPE CVE-2021-41379 File Create Event
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-22
ATT&CK techniques: T1068
Log source: windows/file_event

Description:
Detects signs of the exploitation of LPE CVE-2021-41379 that include an msiexec process that creates an elevation_service.exe file

Detection logic:
{
  "selection": {
    "Image|endswith": "\\msiexec.exe",
    "TargetFilename|startswith": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application",
    "TargetFilename|endswith": "\\elevation_service.exe"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1949/https://github.com/klinix5/InstallerFileTakeOver
  - https://www.zerodayinitiative.com/advisories/ZDI-21-1308/
Sigma Detection Rule: Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2022-01-14
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\ws_TomcatService.exe"
  },
  "filter_main_shells": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
  - https://twitter.com/TheDFIRReport/status/[PII_REDACTED]27244805
  - https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
Sigma Detection Rule: Log4j RCE CVE-2021-44228 in Fields
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-10
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Detection logic:
{
  "selection1": {
    "cs-user-agent|contains": [
      "${jndi:ldap:/",
      "${jndi:rmi:/",
      "${jndi:ldaps:/",
      "${jndi:dns:/",
      "/$%7bjndi:",
      "%24%7bjndi:",
      "$%7Bjndi:",
      "%2524%257Bjndi",
      "%2F%252524%25257Bjndi%3A",
      "${jndi:${lower:",
      "${::-j}${",
      "${jndi:nis",
      "${jndi:nds",
      "${jndi:corba",
      "${jndi:iiop",
      "Reference Class Name: foo",
      "${${env:BARFOO:-j}",
      "${::-l}${::-d}${::-a}${::-p}",
      "${base64:JHtqbmRp",
      "${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$",
      "${${lower:j}ndi:",
      "${${upper:j}ndi:",
      "${${::-j}${::-n}${::-d}${::-i}:"
    ]
  },
  "selection3": {
    "cs-uri-query|contains": [
      "${jndi:ldap:/",
      "${jndi:rmi:/",
      "${jndi:ldaps:/",
      "${jndi:dns:/",
      "/$%7bjndi:",
      "%24%7bjndi:",
      "$%7Bjndi:",
      "%2524%257Bjndi",
      "%2F%252524%25257Bjndi%3A",
      "${jndi:${lower:",
      "${::-j}${",
      "${jndi:nis",
      "${jndi:nds",
      "${jndi:corba",
      "${jndi:iiop",
      "Reference Class Name: foo",
      "${${env:BARFOO:-j}",
      "${::-l}${::-d}${::-a}${::-p}",
      "${base64:JHtqbmRp",
      "${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$",
      "${${lower:j}ndi:",
      "${${upper:j}ndi:",
      "${${::-j}${::-n}${::-d}${::-i}:"
    ]
  },
  "selection4": {
    "cs-referer|contains": [
      "${jndi:ldap:/",
      "${jndi:rmi:/",
      "${jndi:ldaps:/",
      "${jndi:dns:/",
      "/$%7bjndi:",
   

References:
  - https://web.archive.org/web/[PII_REDACTED]0738/https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://news.ycombinator.com/item?id=29504755
  - https://github.com/tangxiaofeng7/apache-log4j-poc
  - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
  - https://github.com/YfryTchsGD/Log4jAttackSurface
Sigma Detection Rule: Log4j RCE CVE-2021-44228 Generic
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-10
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

Detection logic:
{
  "keywords": [
    "${jndi:ldap:/",
    "${jndi:rmi:/",
    "${jndi:ldaps:/",
    "${jndi:dns:/",
    "/$%7bjndi:",
    "%24%7bjndi:",
    "$%7Bjndi:",
    "%2524%257Bjndi",
    "%2F%252524%25257Bjndi%3A",
    "${jndi:${lower:",
    "${::-j}${",
    "${jndi:nis",
    "${jndi:nds",
    "${jndi:corba",
    "${jndi:iiop",
    "Reference Class Name: foo",
    "${${env:BARFOO:-j}",
    "${::-l}${::-d}${::-a}${::-p}",
    "${base64:JHtqbmRp",
    "${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$",
    "${${lower:j}ndi:",
    "${${upper:j}ndi:",
    "${${::-j}${::-n}${::-d}${::-i}:"
  ],
  "filter": [
    "w.nessus.org/nessus",
    "/nessus}"
  ],
  "condition": "keywords and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0738/https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://news.ycombinator.com/item?id=29504755
  - https://github.com/tangxiaofeng7/apache-log4j-poc
  - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
  - https://github.com/YfryTchsGD/Log4jAttackSurface
Sigma Detection Rule: Windows Spooler Service Suspicious Binary Load
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: FPT.EagleEye, Thomas Patzke (improvements)
Date: 2021-06-29
ATT&CK techniques: T1574
Log source: windows/image_load

Description:
Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).


Detection logic:
{
  "selection": {
    "Image|endswith": "\\spoolsv.exe",
    "ImageLoaded|contains": [
      "\\Windows\\System32\\spool\\drivers\\x64\\3\\",
      "\\Windows\\System32\\spool\\drivers\\x64\\4\\"
    ],
    "ImageLoaded|endswith": ".dll"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5600/https://github.com/hhlxf/PrintNightmare/
  - https://github.com/ly4k/SpoolFool
Sigma Detection Rule: Potential PrintNightmare Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-07-01
ATT&CK techniques: T1574
Log source: windows/file_delete

Description:
Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

Detection logic:
{
  "selection": {
    "Image|endswith": "\\spoolsv.exe",
    "TargetFilename|contains": "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5600/https://github.com/hhlxf/PrintNightmare/
  - https://github.com/cube0x0/CVE-2021-1675
Sigma Detection Rule: Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Sittikorn S, Nuttakorn T, Tim Shelton
Date: 2021-07-01
ATT&CK techniques: T1055
Log source: /antivirus

Description:
Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Detection logic:
{
  "selection": {
    "Filename|contains": ":\\Windows\\System32\\spool\\drivers\\x64\\"
  },
  "keywords": [
    "File submitted to Symantec"
  ],
  "condition": "selection and not keywords"
}

References:
  - https://twitter.com/mvelazco/status/[PII_REDACTED]41102338
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
Sigma Detection Rule: PrinterNightmare Mimikatz Driver Name
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Markus Neis, @markus_neis, Florian Roth
Date: 2021-07-04
ATT&CK techniques: T1204
Log source: windows/registry_event

Description:
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Control\\Print\\Environments\\Windows x64\\Drivers\\Version-3\\QMS 810\\",
      "\\Control\\Print\\Environments\\Windows x64\\Drivers\\Version-3\\mimikatz"
    ]
  },
  "selection_alt": {
    "TargetObject|contains|all": [
      "legitprinter",
      "\\Control\\Print\\Environments\\Windows"
    ]
  },
  "selection_print": {
    "TargetObject|contains": [
      "\\Control\\Print\\Environments",
      "\\CurrentVersion\\Print\\Printers"
    ]
  },
  "selection_kiwi": {
    "TargetObject|contains": [
      "Gentil Kiwi",
      "mimikatz printer",
      "Kiwi Legit Printer"
    ]
  },
  "condition": "selection or selection_alt or (selection_print and selection_kiwi)"
}

References:
  - https://github.com/gentilkiwi/mimikatz/commit/c21276072b3f2a47a21e215a46962a17d54b3760
  - https://www.lexjansen.com/sesug/1993/SESUG93035.pdf
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913
  - https://nvd.nist.gov/vuln/detail/cve-2021-1675
  - https://nvd.nist.gov/vuln/detail/cve-2021-34527
Sigma Detection Rule: Possible CVE-2021-1675 Print Spooler Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton
Date: 2021-06-30
ATT&CK techniques: T1569
Log source: windows/

Description:
Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675

Detection logic:
{
  "selection": {
    "EventID": 808,
    "ErrorCode": [
      "0x45A",
      "0x7e"
    ]
  },
  "keywords": [
    "The print spooler failed to load a plug-in module",
    "MyExploit.dll",
    "evil.dll",
    "\\addCube.dll",
    "\\rev.dll",
    "\\rev2.dll",
    "\\main64.dll",
    "\\mimilib.dll",
    "\\mimispool.dll"
  ],
  "falsepositive": [
    " registration timed out"
  ],
  "condition": "(selection or keywords) and not falsepositive"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/[PII_REDACTED]2336/https://github.com/afwu/PrintNightmare
  - https://twitter.com/fuzzyf10w/status/[PII_REDACTED]35898371
Sigma Detection Rule: CVE-2021-1675 Print Spooler Exploitation Filename Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-06-29
ATT&CK techniques: T1587
Log source: windows/file_event

Description:
Detects the default filename used in PoC code against print spooler vulnerability CVE-2021-1675

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\1\\123"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/[PII_REDACTED]2336/https://github.com/afwu/PrintNightmare
  - https://github.com/cube0x0/CVE-2021-1675