Branch was auto-updated.

detections/endpoint/print_spooler_adding_a_printer_driver.yml

@@ -0,0 +1,68 @@
+name: Print Spooler Adding A Printer Driver
+id: 313681a2-da8e-11eb-adad-acde48001122
+version: 1
+date: '2021-07-01'
+author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: 'The following analytic identifies new printer drivers being load by
+  utilizing the Windows PrintService operational logs, EventCode 316. This was identified
+  during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \
+
+  Within the proof of concept code, the following event will occur - "Printer driver
+  1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll,
+  evil.dll. No user action is required." \
+
+  During triage, isolate the endpoint and review for source of exploitation. Capture
+  any additional file modification events and review the source of where the exploitation
+  began.'
+search: '`printservice` EventCode=316 category = "Adding a printer driver" Message
+  = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats  count
+  min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName
+  Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `print_spooler_adding_a_printer_driver_filter`'
+how_to_implement: You will need to ensure PrintService Admin and Operational logs
+  are being logged to Splunk from critical or all systems.
+known_false_positives: Unknown. This may require filtering.
+references:
+- https://twitter.com/MalwareJake/status/1410421445608476679?s=20
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OpCode
+  - EventCode
+  - ComputerName
+  - Message
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Persistence, 
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  message: Suspicious print driver was loaded on endpoint $ComputerName$.
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml

@@ -0,0 +1,61 @@
+name: Print Spooler Failed to Load a Plug-in
+id: 1adc9548-da7c-11eb-8f13-acde48001122
+version: 1
+date: '2021-07-01'
+author: Mauricio Velazco, Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \
+  
+  Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \
+
+  The analytic is based on file path and failure to load the plug-in. \
+
+  During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.'
+search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `print_spooler_failed_to_load_a_plug_in_filter`'
+how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. 
+known_false_positives: False positives are unknown and filtering may be required.
+references:
+  - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+  - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+  - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - OpCode
+  - EventCode
+  - ComputerName
+  - Message
+  security_domain: endpoint
+  impact: 80
+  confidence: 90 
+  # (impact * confidence)/100
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Persistence, 
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. 
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim

detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml

@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Cobalt Strike
+  - PrintNightmare CVE-2021-34527
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log

detections/endpoint/spoolsv_spawning_rundll32.yml

@@ -0,0 +1,77 @@
+name: Spoolsv Spawning Rundll32
+id: 15d905f6-da6b-11eb-ab82-acde48001122
+version: 1
+date: '2021-07-01'
+author: Mauricio Velazco, Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious child process, `rundll32.exe`,
+  with no command-line arguments being spawned from `spoolsv.exe`. This was identified
+  during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal
+  behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint
+  and review for source of exploitation. Capture any additional file modification
+  events.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe
+  Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `spoolsv_spawning_rundll32_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Limited false positives have been identified. There are limited
+  instances where `rundll32.exe` may be spawned by a legitimate print driver.
+references:
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Local
+  message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$.
+    This behavior is suspicious and related to PrintNightmare.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: parent_process_id
+    type: Process
+    role:
+    - Parent Process
+    - Attacker
+  - name: process_id
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/spoolsv_suspicious_loaded_modules.yml

@@ -0,0 +1,66 @@
+name: Spoolsv Suspicious Loaded Modules
+id: a5e451f8-da81-11eb-b245-acde48001122
+version: 1
+date: '2021-07-01'
+author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect suspicious loading of dll in specific path relative
+  to printnightmare exploitation. In this search we try to detect the loaded modules
+  made by spoolsv.exe after the exploitation.
+search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*"
+  ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded)
+  as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `spoolsv_suspicious_loaded_modules_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: unknown
+references:
+- https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - Computer
+  - EventCode
+  - ImageLoaded
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Local
+  message: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$.
+    This behavior is suspicious and related to PrintNightmare.
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_id
+    type: Process Name
+    role:
+    - Parent Process
+    - Attacker
+  - name: ImageLoaded
+    type: File
+    role:
+    - Other
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log

detections/endpoint/spoolsv_suspicious_process_access.yml

@@ -0,0 +1,72 @@
+name: Spoolsv Suspicious Process Access
+id: 799b606e-da81-11eb-93f8-acde48001122
+version: 1
+date: '2021-07-01'
+author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic identifies a suspicious behavior related to PrintNightmare,
+  or CVE-2021-34527 previously (CVE-2021-1675),  to gain privilege escalation on the vulnerable machine. This
+  exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege.
+  This detection is to look for suspicious process access made by the spoolsv.exe
+  that may related to the attack.
+search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*"
+  TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff |
+  stats  count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage
+  TargetImage GrantedAccess CallTrace  EventCode ProcessID| `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with process access event where SourceImage, TargetImage, GrantedAccess and
+  CallTrace executions from your endpoints. If you are using Sysmon, you must have
+  at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe.
+known_false_positives: Unknown. Filter as needed.
+references:
+- https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1068
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage
+  - TargetImage
+  - GrantedAccess
+  - CallTrace
+  - EventCode
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Local
+  message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare.
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: ProcessID
+    type: Process
+    role:
+    - Parent Process
+  - name: TargetImage
+    type: Process Name
+    role:
+    - Target
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log

detections/endpoint/spoolsv_writing_a_dll.yml

@@ -0,0 +1,80 @@
+name: Spoolsv Writing a DLL
+id: d5bf5cf2-da71-11eb-92c2-acde48001122
+version: 1
+date: '2021-07-01'
+author: Mauricio Velazco, Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies a `.dll` being written by `spoolsv.exe`.
+  This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically,
+  this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code
+  used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`.
+  During triage, isolate the endpoint and review for source of exploitation. Capture
+  any additional file modification events.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*"
+  Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.file_create_time
+  Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
+  fields _time dest file_create_time file_name file_path process_name process_path
+  process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
+  process_name | `spoolsv_writing_a_dll_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+known_false_positives: Unknown.
+references:
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.file_path
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.dest
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  message: $process_name$ has been identified writing dll's to $file_path$ on endpoint
+    $dest$. This behavior is suspicious and related to PrintNightmare.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_id
+    type: Process
+    role:
+    - Process
+  - name: file_path
+    type: File
+    role:
+    - Other
+  automated_detection_testing: passed

detections/endpoint/spoolsv_writing_a_dll___sysmon.yml

@@ -0,0 +1,74 @@
+name: Spoolsv Writing a DLL - Sysmon
+id: 347fd388-da87-11eb-836d-acde48001122
+version: 1
+date: '2021-07-01'
+author: Mauricio Velazco, Michael Haag, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic identifies a `.dll` being written by `spoolsv.exe`.
+  This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically,
+  this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code
+  used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`.
+  During triage, isolate the endpoint and review for source of exploitation. Capture
+  any additional file modification events.
+search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*"
+  file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by
+  dest, UserID, process_name, file_path, file_name, TargetFilename, process_id | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: Limited false positives. Filter as needed.
+references:
+- https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1547.012
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - UserID
+  - process_name
+  - file_path
+  - file_name
+  - TargetFilename
+  security_domain: endpoint
+  impact: 80
+  confidence: 90
+  risk_score: 72
+  context:
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Local
+  message: $process_name$ has been identified writing dll's to $file_path$ on endpoint
+    $dest$. This behavior is suspicious and related to PrintNightmare.
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: process_id
+    type: Process
+    role:
+    - Process
+  - name: file_path
+    type: File
+    role:
+    - Other
+  automated_detection_testing: passed

detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml

@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Suspicious Rundll32 Activity
   - Cobalt Strike
+  - PrintNightmare CVE-2021-34527
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:

macros/printservice.yml

@@ -0,0 +1,4 @@
+definition: source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: printservice

stories/printnightmare_cve_2021_34527.yml

@@ -0,0 +1,34 @@
+name: PrintNightmare CVE-2021-34527
+id: fd79470a-da88-11eb-b803-acde48001122
+version: 1
+date: '2021-07-01'
+author: Splunk Threat Research Team
+type: batch
+description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine.
+narrative: 'This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \
+
+  The prerequisites for successful exploitation consist of: \
+
+  1. Print Spooler service enabled on the target system \
+
+  1. Network connectivity to the target system (initial access has been obtained) \ 
+  
+  1. Hash or password for a low privileged user ( or computer ) account. \
+
+  In the most impactful scenario, an attacker would be able to leverage this vulnerability to obtain a SYSTEM shell on a domain controller and so escalate their privileges from a low privileged domain account to full domain access in the target environment as shown below.'
+references:
+  - https://github.com/cube0x0/CVE-2021-1675/
+  - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+  - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+  - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+tags:
+  analytic_story:
+  - PrintNightmare CVE-2021-34527
+  category:
+  - Lateral Movement
+  - Privilege Escalation
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

tests/endpoint/print_spooler_adding_a_printer_driver.test.yml

@@ -0,0 +1,12 @@
+name: Print Spooler Adding A Printer Driver Unit Test
+tests:
+- name: Print Spooler Adding A Printer Driver
+  file: endpoint/print_spooler_adding_a_printer_driver.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-printservice_operational.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log
+    source: WinEventLog:Microsoft-Windows-PrintService/Operational
+    sourcetype: WinEventLog

tests/endpoint/print_spooler_failed_to_load_a_plug_in.test.yml

@@ -0,0 +1,12 @@
+name: Print Spooler Failed to Load a Plug-in Unit Test
+tests:
+- name: Print Spooler Failed to Load a Plug-in
+  file: endpoint/print_spooler_failed_to_load_a_plug_in.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-printservice_admin.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_admin.log
+    source: WinEventLog:Microsoft-Windows-PrintService/Admin
+    sourcetype: WinEventLog

tests/endpoint/spoolsv_spawning_rundll32.test.yml

@@ -0,0 +1,12 @@
+name: Spoolsv Spawning Rundll32 Unit Test
+tests:
+- name: Spoolsv Spawning Rundll32
+  file: endpoint/spoolsv_spawning_rundll32.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml

@@ -0,0 +1,12 @@
+name: Spoolsv Suspicious Loaded Modules
+tests:
+- name: Spoolsv Suspicious Loaded Modules
+  file: endpoint/spoolsv_suspicious_loaded_modules.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/spoolsv_suspicious_process_access.test.yml

@@ -0,0 +1,12 @@
+name: Spoolsv Suspicious Process Access
+tests:
+- name: Spoolsv Suspicious Process Access
+  file: endpoint/spoolsv_suspicious_process_access.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/spoolsv_writing_a_dll.test.yml

@@ -0,0 +1,12 @@
+name: Spoolsv Writing a DLL Unit Test
+tests:
+- name: Spoolsv Writing a DLL
+  file: endpoint/spoolsv_writing_a_dll.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml

@@ -0,0 +1,12 @@
+name: Spoolsv Writing a DLL - Sysmon Unit Test
+tests:
+- name: Spoolsv Writing a DLL - Sysmon
+  file: endpoint/spoolsv_writing_a_dll___sysmon.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog