admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update printnightmare_cve_2021_1675.yml

Browse Source
This commit is contained in:
mhaag-spl
2021-07-01 12:20:34 -06:00
parent a1a6fe9258
commit 5c29c36356
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stories/printnightmare_cve_2021_1675.yml
+2 -2
View File
@@ -7,8 +7,8 @@ type: batch
description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine.
narrative: 'This analytic story identifies a recent critical vulnerability in the Windows Print Spooling service - CVE-2021-1675. Proof of concept code has been released publicly, but a thorough patch has not. \
Typical behavior of spoolsv.exe may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified spoolsv.exe writing DLL's to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \
Typical behavior of `spoolsv.exe` may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified `spoolsv.exe` writing DLLs to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \
In addition to ensuring logging and visibility is present, to exploit this vulnerability, the adversary will need access to the environment, the payload on disk, SMB share, and use of credentials to spread.'
references:
- https://github.com/cube0x0/CVE-2021-1675/