From 5c29c36356366c38c3bd99b6735d02be2eee792b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 12:20:34 -0600 Subject: [PATCH] Update printnightmare_cve_2021_1675.yml --- stories/printnightmare_cve_2021_1675.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/printnightmare_cve_2021_1675.yml b/stories/printnightmare_cve_2021_1675.yml index 1db1ee3ebf..d623cad193 100644 --- a/stories/printnightmare_cve_2021_1675.yml +++ b/stories/printnightmare_cve_2021_1675.yml @@ -7,8 +7,8 @@ type: batch description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. narrative: 'This analytic story identifies a recent critical vulnerability in the Windows Print Spooling service - CVE-2021-1675. Proof of concept code has been released publicly, but a thorough patch has not. \ - Typical behavior of spoolsv.exe may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified spoolsv.exe writing DLL's to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ - + Typical behavior of `spoolsv.exe` may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified `spoolsv.exe` writing DLLs to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ + In addition to ensuring logging and visibility is present, to exploit this vulnerability, the adversary will need access to the environment, the payload on disk, SMB share, and use of credentials to spread.' references: - https://github.com/cube0x0/CVE-2021-1675/