From e86a988621d3ab36b0bf84ed1d6f4e1c55f86115 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 12:01:45 -0600 Subject: [PATCH 01/22] Printing All your Nightmares --- .../print_spooler_adding_a_printer_driver.yml | 57 ++++++++++++++ ...print_spooler_failed_to_load_a_plug_in.yml | 62 +++++++++++++++ ...no_command_line_arguments_with_network.yml | 1 + .../endpoint/spoolsv_spawning_rundll32.yml | 67 ++++++++++++++++ .../spoolsv_suspicious_loaded_modules.yml | 61 +++++++++++++++ .../spoolsv_suspicious_process_access.yml | 67 ++++++++++++++++ detections/endpoint/spoolsv_writing_a_dll.yml | 78 +++++++++++++++++++ .../spoolsv_writing_a_dll___sysmon.yml | 67 ++++++++++++++++ ...undll32_with_no_command_line_arguments.yml | 1 + stories/printnightmare_cve_2021_1675.yml | 26 +++++++ ...t_spooler_adding_a_printer_driver.test.yml | 12 +++ ..._spooler_failed_to_load_a_plug_in.test.yml | 12 +++ .../spoolsv_spawning_rundll32.test.yml | 12 +++ ...spoolsv_suspicious_loaded_modules.test.yml | 12 +++ ...spoolsv_suspicious_process_access.test.yml | 12 +++ tests/endpoint/spoolsv_writing_a_dll.test.yml | 12 +++ .../spoolsv_writing_a_dll___sysmon.test.yml | 12 +++ 17 files changed, 571 insertions(+) create mode 100644 detections/endpoint/print_spooler_adding_a_printer_driver.yml create mode 100644 detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml create mode 100644 detections/endpoint/spoolsv_spawning_rundll32.yml create mode 100644 detections/endpoint/spoolsv_suspicious_loaded_modules.yml create mode 100644 detections/endpoint/spoolsv_suspicious_process_access.yml create mode 100644 detections/endpoint/spoolsv_writing_a_dll.yml create mode 100644 detections/endpoint/spoolsv_writing_a_dll___sysmon.yml create mode 100644 stories/printnightmare_cve_2021_1675.yml create mode 100644 tests/endpoint/print_spooler_adding_a_printer_driver.test.yml create mode 100644 tests/endpoint/print_spooler_failed_to_load_a_plug_in.test.yml create mode 100644 tests/endpoint/spoolsv_spawning_rundll32.test.yml create mode 100644 tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml create mode 100644 tests/endpoint/spoolsv_suspicious_process_access.test.yml create mode 100644 tests/endpoint/spoolsv_writing_a_dll.test.yml create mode 100644 tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml new file mode 100644 index 0000000000..346ed99606 --- /dev/null +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -0,0 +1,57 @@ +name: Print Spooler Adding A Printer Driver +id: 313681a2-da8e-11eb-adad-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +datamodel: +- Endpoint +description: 'The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-1675 or PrintNightmare. \ + + Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ + + During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began.' +search: 'source="wineventlog:microsoft-windows-printservice/operational" EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" + | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `print_spooler_adding_a_printer_driver_filter`' +how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +known_false_positives: Unknown. This may require filtering. +references: + - https://twitter.com/MalwareJake/status/1410421445608476679?s=20 + - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - OpCode + - EventCode + - ComputerName + - Message + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source: Endpoint + - Stage: Persistence, Privilege Escalation, Defense Evasion + message: Suspicious print driver was loaded on endpoint $ComputerName$. + observable: + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml new file mode 100644 index 0000000000..2cf300b09b --- /dev/null +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -0,0 +1,62 @@ +name: Print Spooler Failed to Load a Plug-in +id: 1adc9548-da7c-11eb-8f13-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +datamodel: +- Endpoint +description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-1675 or PrintNightmare. \ + + Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ + + The analytic is based on file path and failure to load the plug-in. \ + + During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.' +search: 'sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" + ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) +| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter`' +how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +known_false_positives: False positives are unknown and filtering may be required. +references: + - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - OpCode + - EventCode + - ComputerName + - Message + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source: Endpoint + - Stage: Persistence, Privilege Escalation, Defense Evasion + message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + - name: EventCode + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index d30c7f6249..e101b0387f 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -36,6 +36,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Cobalt Strike + - PrintNightmare CVE-2021-1675 automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml new file mode 100644 index 0000000000..f6fcd5c430 --- /dev/null +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -0,0 +1,67 @@ +name: Spoolsv Spawning Rundll32 +id: 15d905f6-da6b-11eb-ab82-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +datamodel: +- Endpoint +description: The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. + During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `spoolsv_spawning_rundll32_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. +references: + - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source: Endpoint + - Stage: Privilege Escalation, Defense Evasion + message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + - name: parent_process + type: Process Name + role: + - Parent Process + - name: process_name + type: Process Name + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml new file mode 100644 index 0000000000..747e70207c --- /dev/null +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -0,0 +1,61 @@ +name: Spoolsv Suspicious Loaded Modules +id: a5e451f8-da81-11eb-b245-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. + In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. +search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" + | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer EventCode + | where countImgloaded >= 3 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `spoolsv_suspicious_loaded_modules_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and imageloaded executions from your endpoints. If you + are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: unknown +references: + - https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - Computer + - EventCode + - ImageLoaded + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source: Endpoint + - Stage: Privilege Escalation, Defense Evasion + message: $Image$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. + observable: + - name: Computer + type: Endpoint + role: + - Victim + - name: Image + type: Process Name + role: + - Parent Process + - name: ImageLoaded + type: Location + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml new file mode 100644 index 0000000000..d13a42c0b8 --- /dev/null +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -0,0 +1,67 @@ +name: Spoolsv Suspicious Process Access +id: 799b606e-da81-11eb-93f8-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +datamodel: +- Endpoint +description: This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. + This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made + by the spoolsv.exe that may related to the attack. +search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" + TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff + | stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage TargetImage GrantedAccess CallTrace EventCode + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `spoolsv_suspicious_process_access_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of spoolsv.exe. +known_false_positives: Unknown. Filter as needed. +references: + - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 + - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1068 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - SourceImage + - TargetImage + - GrantedAccess + - CallTrace + - EventCode + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source: Endpoint + - Stage: Privilege Escalation, Defense Evasion + message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. + observable: + - name: Computer + type: Endpoint + role: + - Victim + - name: SourceImage + type: Process Name + role: + - Process + - name: TargetImage + type: Process Name + role: + - Process \ No newline at end of file diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml new file mode 100644 index 0000000000..2213b62d6e --- /dev/null +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -0,0 +1,78 @@ +name: Spoolsv Writing a DLL +id: d5bf5cf2-da71-11eb-92c2-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +datamodel: +- Endpoint +description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. + During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name + Processes.dest +| `drop_dm_object_name(Processes)` +| join process_guid, _time + [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" + by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path + | `drop_dm_object_name(Filesystem)` + | fields _time dest file_create_time + file_name file_path process_name process_path process] +| dedup file_create_time +| table dest file_create_time, file_name, file_path, process_name +| `spoolsv_writing_a_dll_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: Unknown. +references: + - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Filesystem.dest + - Filesystem.file_create_time + - Filesystem.file_name + - Filesystem.file_path + - Processes.process_name + - Processes.process_id + - Processes.process_name + - Processes.dest + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source: Endpoint + - Stage: Privilege Escalation, Defense Evasion + message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Process + - name: file_path + type: Location + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml new file mode 100644 index 0000000000..d356d11a2f --- /dev/null +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -0,0 +1,67 @@ +name: Spoolsv Writing a DLL - Sysmon +id: 347fd388-da87-11eb-836d-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +datamodel: +- Endpoint +description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. + During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll + | stats count min(_time) as firstTime max(_time) as lastTime by dest, UserID, process_name, file_path, file_name, TargetFilename + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `spoolsv_writing_a_dll___sysmon_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: Limited false positives. Filter as needed. +references: + - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 + - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + dataset: [] + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1547.012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - UserID + - process_name + - file_path + - file_name + - TargetFilename + security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source: Endpoint + - Stage: Privilege Escalation, Defense Evasion + message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: process_name + type: Process Name + role: + - Process + - name: file_path + type: Location + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index 94dba2d4ef..ccb1421e3d 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -31,6 +31,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Cobalt Strike + - PrintNightmare CVE-2021-1675 asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/stories/printnightmare_cve_2021_1675.yml b/stories/printnightmare_cve_2021_1675.yml new file mode 100644 index 0000000000..6d76b0ac51 --- /dev/null +++ b/stories/printnightmare_cve_2021_1675.yml @@ -0,0 +1,26 @@ +name: PrintNightmare CVE-2021-1675 +id: fd79470a-da88-11eb-b803-acde48001122 +version: 1 +date: '2021-07-01' +author: Splunk Threat Research Team +type: batch +description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. +narrative: 'This analytic story identifies a recent critical vulnerability in the Windows Print Spooling service - CVE-2021-1675. Proof of concept code has been released publicly, but a thorough patch has not. \ + Typical behavior of `spoolsv.exe` may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified `spoolsv.exe` writing DLL's to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ + In addition to ensuring logging and visibility is present, to exploit this vulnerability, the adversary will need access to the environment, the payload on disk, SMB share, and use of credentials to spread.' +references: + - https://github.com/cube0x0/CVE-2021-1675/ + - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ + - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ + - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +tags: + analytic_story: + - PrintNightmare CVE-2021-1675 + category: + - Lateral Movement + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/print_spooler_adding_a_printer_driver.test.yml b/tests/endpoint/print_spooler_adding_a_printer_driver.test.yml new file mode 100644 index 0000000000..c25433cc61 --- /dev/null +++ b/tests/endpoint/print_spooler_adding_a_printer_driver.test.yml @@ -0,0 +1,12 @@ +name: Print Spooler Adding A Printer Driver Unit Test +tests: +- name: Print Spooler Adding A Printer Driver + file: endpoint/print_spooler_adding_a_printer_driver.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-printservice_operational.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log + source: WinEventLog:Microsoft-Windows-PrintService/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/print_spooler_failed_to_load_a_plug_in.test.yml b/tests/endpoint/print_spooler_failed_to_load_a_plug_in.test.yml new file mode 100644 index 0000000000..162c929591 --- /dev/null +++ b/tests/endpoint/print_spooler_failed_to_load_a_plug_in.test.yml @@ -0,0 +1,12 @@ +name: Print Spooler Failed to Load a Plug-in Unit Test +tests: +- name: Print Spooler Failed to Load a Plug-in + file: endpoint/print_spooler_failed_to_load_a_plug_in.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-printservice_admin.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_admin.log + source: WinEventLog:Microsoft-Windows-PrintService/Admin + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/spoolsv_spawning_rundll32.test.yml b/tests/endpoint/spoolsv_spawning_rundll32.test.yml new file mode 100644 index 0000000000..dedc9d32ed --- /dev/null +++ b/tests/endpoint/spoolsv_spawning_rundll32.test.yml @@ -0,0 +1,12 @@ +name: Spoolsv Spawning Rundll32 Unit Test +tests: +- name: Spoolsv Spawning Rundll32 + file: endpoint/spoolsv_spawning_rundll32.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml b/tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml new file mode 100644 index 0000000000..b3383c56f7 --- /dev/null +++ b/tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml @@ -0,0 +1,12 @@ +name: Spoolsv Suspicious Loaded Modules +tests: +- name: Spoolsv Suspicious Loaded Modules + file: detections/spoolsv_suspicious_loaded_modules.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/spoolsv_suspicious_process_access.test.yml b/tests/endpoint/spoolsv_suspicious_process_access.test.yml new file mode 100644 index 0000000000..051478ca95 --- /dev/null +++ b/tests/endpoint/spoolsv_suspicious_process_access.test.yml @@ -0,0 +1,12 @@ +name: Spoolsv Suspicious Process Access +tests: +- name: Spoolsv Suspicious Process Access + file: detections/spoolsv_suspicious_process_access.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/spoolsv_writing_a_dll.test.yml b/tests/endpoint/spoolsv_writing_a_dll.test.yml new file mode 100644 index 0000000000..71c98a2d12 --- /dev/null +++ b/tests/endpoint/spoolsv_writing_a_dll.test.yml @@ -0,0 +1,12 @@ +name: Spoolsv Writing a DLL Unit Test +tests: +- name: Spoolsv Writing a DLL + file: detections/endpoint/spoolsv_writing_a_dll.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml b/tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml new file mode 100644 index 0000000000..c92302b63e --- /dev/null +++ b/tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml @@ -0,0 +1,12 @@ +name: Spoolsv Writing a DLL - Sysmon Unit Test +tests: +- name: Spoolsv Writing a DLL - Sysmon + file: detections/endpoint/spoolsv_writing_a_dll___sysmon.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 0c86774b157fb2378ef9f5d1524278a46b31fbd4 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 12:11:49 -0600 Subject: [PATCH 02/22] Added a Macro --- detections/endpoint/print_spooler_adding_a_printer_driver.yml | 2 +- .../endpoint/print_spooler_failed_to_load_a_plug_in.yml | 2 +- macros/printservice.yml | 4 ++++ 3 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 macros/printservice.yml diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 346ed99606..1ac8dfbfa4 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -11,7 +11,7 @@ description: 'The following analytic identifies new printer drivers being load b Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began.' -search: 'source="wineventlog:microsoft-windows-printservice/operational" EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" +search: '`printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 2cf300b09b..2fd91c09f1 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -13,7 +13,7 @@ description: 'The following analytic identifies driver load errors utilizing the The analytic is based on file path and failure to load the plug-in. \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.' -search: 'sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` diff --git a/macros/printservice.yml b/macros/printservice.yml new file mode 100644 index 0000000000..b9da8fea7c --- /dev/null +++ b/macros/printservice.yml @@ -0,0 +1,4 @@ +definition: source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: printservice From 97e039bdce1df6d0d733e85fb8a83fc6a2b40791 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 12:14:19 -0600 Subject: [PATCH 03/22] Path issues --- tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml | 2 +- tests/endpoint/spoolsv_suspicious_process_access.test.yml | 2 +- tests/endpoint/spoolsv_writing_a_dll.test.yml | 2 +- tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml b/tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml index b3383c56f7..5f27b94343 100644 --- a/tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml +++ b/tests/endpoint/spoolsv_suspicious_loaded_modules.test.yml @@ -1,7 +1,7 @@ name: Spoolsv Suspicious Loaded Modules tests: - name: Spoolsv Suspicious Loaded Modules - file: detections/spoolsv_suspicious_loaded_modules.yml + file: endpoint/spoolsv_suspicious_loaded_modules.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/spoolsv_suspicious_process_access.test.yml b/tests/endpoint/spoolsv_suspicious_process_access.test.yml index 051478ca95..c34d84ef7a 100644 --- a/tests/endpoint/spoolsv_suspicious_process_access.test.yml +++ b/tests/endpoint/spoolsv_suspicious_process_access.test.yml @@ -1,7 +1,7 @@ name: Spoolsv Suspicious Process Access tests: - name: Spoolsv Suspicious Process Access - file: detections/spoolsv_suspicious_process_access.yml + file: endpoint/spoolsv_suspicious_process_access.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/spoolsv_writing_a_dll.test.yml b/tests/endpoint/spoolsv_writing_a_dll.test.yml index 71c98a2d12..1e3b76665c 100644 --- a/tests/endpoint/spoolsv_writing_a_dll.test.yml +++ b/tests/endpoint/spoolsv_writing_a_dll.test.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL Unit Test tests: - name: Spoolsv Writing a DLL - file: detections/endpoint/spoolsv_writing_a_dll.yml + file: endpoint/spoolsv_writing_a_dll.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml b/tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml index c92302b63e..4dc0ab6b52 100644 --- a/tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml +++ b/tests/endpoint/spoolsv_writing_a_dll___sysmon.test.yml @@ -1,7 +1,7 @@ name: Spoolsv Writing a DLL - Sysmon Unit Test tests: - name: Spoolsv Writing a DLL - Sysmon - file: detections/endpoint/spoolsv_writing_a_dll___sysmon.yml + file: endpoint/spoolsv_writing_a_dll___sysmon.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From a1a6fe9258881cf321c6b7076eaa1de979ca76f3 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 12:18:34 -0600 Subject: [PATCH 04/22] Update printnightmare_cve_2021_1675.yml --- stories/printnightmare_cve_2021_1675.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/stories/printnightmare_cve_2021_1675.yml b/stories/printnightmare_cve_2021_1675.yml index 6d76b0ac51..1db1ee3ebf 100644 --- a/stories/printnightmare_cve_2021_1675.yml +++ b/stories/printnightmare_cve_2021_1675.yml @@ -6,7 +6,9 @@ author: Splunk Threat Research Team type: batch description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. narrative: 'This analytic story identifies a recent critical vulnerability in the Windows Print Spooling service - CVE-2021-1675. Proof of concept code has been released publicly, but a thorough patch has not. \ - Typical behavior of `spoolsv.exe` may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified `spoolsv.exe` writing DLL's to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ + + Typical behavior of spoolsv.exe may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified spoolsv.exe writing DLL's to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ + In addition to ensuring logging and visibility is present, to exploit this vulnerability, the adversary will need access to the environment, the payload on disk, SMB share, and use of credentials to spread.' references: - https://github.com/cube0x0/CVE-2021-1675/ From 5c29c36356366c38c3bd99b6735d02be2eee792b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 12:20:34 -0600 Subject: [PATCH 05/22] Update printnightmare_cve_2021_1675.yml --- stories/printnightmare_cve_2021_1675.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/printnightmare_cve_2021_1675.yml b/stories/printnightmare_cve_2021_1675.yml index 1db1ee3ebf..d623cad193 100644 --- a/stories/printnightmare_cve_2021_1675.yml +++ b/stories/printnightmare_cve_2021_1675.yml @@ -7,8 +7,8 @@ type: batch description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. narrative: 'This analytic story identifies a recent critical vulnerability in the Windows Print Spooling service - CVE-2021-1675. Proof of concept code has been released publicly, but a thorough patch has not. \ - Typical behavior of spoolsv.exe may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified spoolsv.exe writing DLL's to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ - + Typical behavior of `spoolsv.exe` may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified `spoolsv.exe` writing DLLs to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ + In addition to ensuring logging and visibility is present, to exploit this vulnerability, the adversary will need access to the environment, the payload on disk, SMB share, and use of credentials to spread.' references: - https://github.com/cube0x0/CVE-2021-1675/ From e5d0c5789dfa87ceb8ba0426b8d5f7c332a80bfc Mon Sep 17 00:00:00 2001 From: root Date: Thu, 1 Jul 2021 18:56:49 +0000 Subject: [PATCH 06/22] Added detection testing service results inPrint Spooler Adding A Printer Driver --- .../print_spooler_adding_a_printer_driver.yml | 46 +++++++++++-------- 1 file changed, 27 insertions(+), 19 deletions(-) diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 1ac8dfbfa4..348e5cc6d8 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -6,27 +6,35 @@ author: Splunk Threat Research Team type: batch datamodel: - Endpoint -description: 'The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-1675 or PrintNightmare. \ - - Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, evil.dll. No user action is required." \ +description: 'The following analytic identifies new printer drivers being load by + utilizing the Windows PrintService operational logs, EventCode 316. This was identified + during our testing of CVE-2021-1675 or PrintNightmare. \ - During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events and review the source of where the exploitation began.' -search: '`printservice` EventCode=316 category = "Adding a printer driver" Message = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" - | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `print_spooler_adding_a_printer_driver_filter`' -how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. + Within the proof of concept code, the following event will occur - "Printer driver + 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, + evil.dll. No user action is required." \ + + During triage, isolate the endpoint and review for source of exploitation. Capture + any additional file modification events and review the source of where the exploitation + began.' +search: '`printservice` EventCode=316 category = "Adding a printer driver" Message + = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats count + min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName + Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `print_spooler_adding_a_printer_driver_filter`' +how_to_implement: You will need to ensure PrintService Admin and Operational logs + are being logged to Splunk from critical or all systems. known_false_positives: Unknown. This may require filtering. references: - - https://twitter.com/MalwareJake/status/1410421445608476679?s=20 - - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ - - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ - - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +- https://twitter.com/MalwareJake/status/1410421445608476679?s=20 +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-1675 - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,15 +51,15 @@ tags: - Message security_domain: endpoint impact: 80 - confidence: 90 - # (impact * confidence)/100 + confidence: 90 risk_score: 72 context: - Source: Endpoint - Stage: Persistence, Privilege Escalation, Defense Evasion - message: Suspicious print driver was loaded on endpoint $ComputerName$. + message: Suspicious print driver was loaded on endpoint $ComputerName$. observable: - name: ComputerName type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 917958cb792c11697d6db076666dbef11ab2b1f6 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 1 Jul 2021 19:22:08 +0000 Subject: [PATCH 07/22] Added detection testing service results inSpoolsv Suspicious Loaded Modules --- .../spoolsv_suspicious_loaded_modules.yml | 27 ++++++++++--------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 747e70207c..852b789327 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -6,20 +6,20 @@ author: Splunk Threat Research Team type: batch datamodel: - Endpoint -description: This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. - In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. -search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" - | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer EventCode - | where countImgloaded >= 3 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: This search is to detect suspicious loading of dll in specific path relative + to printnightmare exploitation. In this search we try to detect the loaded modules + made by spoolsv.exe after the exploitation. +search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" + ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) + as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer + EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: unknown references: - - https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml +- https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml tags: analytic_story: - PrintNightmare CVE-2021-1675 @@ -39,13 +39,13 @@ tags: - ImageLoaded security_domain: endpoint impact: 80 - confidence: 90 - # (impact * confidence)/100 + confidence: 90 risk_score: 72 context: - Source: Endpoint - Stage: Privilege Escalation, Defense Evasion - message: $Image$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. + message: $Image$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. + This behavior is suspicious and related to PrintNightmare. observable: - name: Computer type: Endpoint @@ -58,4 +58,7 @@ tags: - name: ImageLoaded type: Location role: - - Other \ No newline at end of file + - Other + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log From 34e0b36bb8eb2c674b78b8f39d89590dff738a42 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 1 Jul 2021 19:22:42 +0000 Subject: [PATCH 08/22] Added detection testing service results inSpoolsv Spawning Rundll32 --- .../endpoint/spoolsv_spawning_rundll32.yml | 39 +++++++++++-------- 1 file changed, 23 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index f6fcd5c430..21c60bc0eb 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -6,26 +6,32 @@ author: Splunk Threat Research Team type: batch datamodel: - Endpoint -description: The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. - During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +description: The following analytic identifies a suspicious child process, `rundll32.exe`, + with no command-line arguments being spawned from `spoolsv.exe`. This was identified + during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal + behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint + and review for source of exploitation. Capture any additional file modification + events. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id -| `drop_dm_object_name(Processes)` -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `spoolsv_spawning_rundll32_filter`' + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe + Processes.process_name=rundll32.exe by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `spoolsv_spawning_rundll32_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -known_false_positives: Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver. +known_false_positives: Limited false positives have been identified. There are limited + instances where `rundll32.exe` may be spawned by a legitimate print driver. references: - - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ - - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ - - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-1675 - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,13 +51,13 @@ tags: - Processes.parent_process_id security_domain: endpoint impact: 80 - confidence: 90 - # (impact * confidence)/100 + confidence: 90 risk_score: 72 context: - Source: Endpoint - Stage: Privilege Escalation, Defense Evasion - message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. + message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. + This behavior is suspicious and related to PrintNightmare. observable: - name: ComputerName type: Endpoint @@ -64,4 +70,5 @@ tags: - name: process_name type: Process Name role: - - Child Process \ No newline at end of file + - Child Process + automated_detection_testing: passed From 6c226fb4bec23156494ee51dacd4ae99462b9db8 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 1 Jul 2021 19:50:04 +0000 Subject: [PATCH 09/22] Added detection testing service results inSpoolsv Suspicious Process Access --- .../spoolsv_suspicious_process_access.yml | 52 ++++++++++--------- 1 file changed, 28 insertions(+), 24 deletions(-) diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index d13a42c0b8..5a401e59e3 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -6,25 +6,26 @@ author: Splunk Threat Research Team type: batch datamodel: - Endpoint -description: This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. - This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made - by the spoolsv.exe that may related to the attack. -search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" - TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff - | stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage TargetImage GrantedAccess CallTrace EventCode - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `spoolsv_suspicious_process_access_filter`' +description: This analytic identifies a suspicious behavior related to PrintNightmare, + or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. This + exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. + This detection is to look for suspicious process access made by the spoolsv.exe + that may related to the attack. +search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" + TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | + stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage + TargetImage GrantedAccess CallTrace EventCode | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances of spoolsv.exe. + logs with process access event where SourceImage, TargetImage, GrantedAccess and + CallTrace executions from your endpoints. If you are using Sysmon, you must have + at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe. known_false_positives: Unknown. Filter as needed. references: - - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 - - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ - - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ - - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +- https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-1675 @@ -38,20 +39,20 @@ tags: - Splunk Cloud required_fields: - _time - - SourceImage - - TargetImage - - GrantedAccess - - CallTrace + - SourceImage + - TargetImage + - GrantedAccess + - CallTrace - EventCode security_domain: endpoint impact: 80 - confidence: 90 - # (impact * confidence)/100 + confidence: 90 risk_score: 72 context: - Source: Endpoint - Stage: Privilege Escalation, Defense Evasion - message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. + message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint + $Computer$. This behavior is suspicious and related to PrintNightmare. observable: - name: Computer type: Endpoint @@ -64,4 +65,7 @@ tags: - name: TargetImage type: Process Name role: - - Process \ No newline at end of file + - Process + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log From 19e28a12ffc27e16188b7b77de0432e3ef55be90 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 1 Jul 2021 19:51:09 +0000 Subject: [PATCH 10/22] Added detection testing service results inSpoolsv Writing a DLL --- detections/endpoint/spoolsv_writing_a_dll.yml | 61 ++++++++++--------- 1 file changed, 31 insertions(+), 30 deletions(-) diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 2213b62d6e..097fa06e9d 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -6,36 +6,36 @@ author: Splunk Threat Research Team type: batch datamodel: - Endpoint -description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. - During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. +description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. + This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, + this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code + used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. + During triage, isolate the endpoint and review for source of exploitation. Capture + any additional file modification events. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name - Processes.dest -| `drop_dm_object_name(Processes)` -| join process_guid, _time - [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" Filesystem.file_name="*.dll" - by _time Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.file_path - | `drop_dm_object_name(Filesystem)` - | fields _time dest file_create_time - file_name file_path process_name process_path process] -| dedup file_create_time -| table dest file_create_time, file_name, file_path, process_name -| `spoolsv_writing_a_dll_filter`' + where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name + Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| + tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path="*\\spool\\drivers\\x64\\*" + Filesystem.file_name="*.dll" by _time Filesystem.dest Filesystem.file_create_time + Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | + fields _time dest file_create_time file_name file_path process_name process_path + process] | dedup file_create_time | table dest file_create_time, file_name, file_path, + process_name | `spoolsv_writing_a_dll_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. -known_false_positives: Unknown. +known_false_positives: Unknown. references: - - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ - - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ - - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-1675 - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -46,23 +46,23 @@ tags: - Splunk Cloud required_fields: - _time - - Filesystem.dest - - Filesystem.file_create_time + - Filesystem.dest + - Filesystem.file_create_time - Filesystem.file_name - - Filesystem.file_path + - Filesystem.file_path - Processes.process_name - - Processes.process_id + - Processes.process_id - Processes.process_name - - Processes.dest + - Processes.dest security_domain: endpoint impact: 80 - confidence: 90 - # (impact * confidence)/100 + confidence: 90 risk_score: 72 context: - Source: Endpoint - Stage: Privilege Escalation, Defense Evasion - message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. + message: $process_name$ has been identified writing dll's to $file_path$ on endpoint + $dest$. This behavior is suspicious and related to PrintNightmare. observable: - name: dest type: Endpoint @@ -75,4 +75,5 @@ tags: - name: file_path type: Location role: - - Other \ No newline at end of file + - Other + automated_detection_testing: passed From 20d19f74a5c8ae0e53f3f954b5f16a41dc40e1db Mon Sep 17 00:00:00 2001 From: root Date: Thu, 1 Jul 2021 20:01:15 +0000 Subject: [PATCH 11/22] Added detection testing service results inSpoolsv Writing a DLL - Sysmon --- .../spoolsv_writing_a_dll___sysmon.yml | 37 +++++++++++-------- 1 file changed, 21 insertions(+), 16 deletions(-) diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index d356d11a2f..93d563a8ab 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -6,27 +6,31 @@ author: Splunk Threat Research Team type: batch datamodel: - Endpoint -description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. - During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. -search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll - | stats count min(_time) as firstTime max(_time) as lastTime by dest, UserID, process_name, file_path, file_name, TargetFilename - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `spoolsv_writing_a_dll___sysmon_filter`' +description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. + This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, + this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code + used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. + During triage, isolate the endpoint and review for source of exploitation. Capture + any additional file modification events. +search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" + file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by + dest, UserID, process_name, file_path, file_name, TargetFilename | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: Limited false positives. Filter as needed. references: - - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 - - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ - - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ - - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes +- https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818 +- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ +- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/ +- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - PrintNightmare CVE-2021-1675 - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,13 +49,13 @@ tags: - TargetFilename security_domain: endpoint impact: 80 - confidence: 90 - # (impact * confidence)/100 + confidence: 90 risk_score: 72 context: - Source: Endpoint - Stage: Privilege Escalation, Defense Evasion - message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. + message: $process_name$ has been identified writing dll's to $file_path$ on endpoint + $dest$. This behavior is suspicious and related to PrintNightmare. observable: - name: dest type: Endpoint @@ -64,4 +68,5 @@ tags: - name: file_path type: Location role: - - Other \ No newline at end of file + - Other + automated_detection_testing: passed From 3c1be9b42f5f6a676da85db197821409e05876aa Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 14:08:34 -0600 Subject: [PATCH 12/22] Update print_spooler_failed_to_load_a_plug_in.yml --- .../print_spooler_failed_to_load_a_plug_in.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 2fd91c09f1..626dd70d3b 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -13,11 +13,11 @@ description: 'The following analytic identifies driver load errors utilizing the The analytic is based on file path and failure to load the plug-in. \ During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events.' -search: '`printservice` - ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) -| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter`' +search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) + | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `print_spooler_failed_to_load_a_plug_in_filter`' how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. known_false_positives: False positives are unknown and filtering may be required. references: From 8e06807020fd90175b5eb9799e40feb7c2a0c80b Mon Sep 17 00:00:00 2001 From: root Date: Thu, 1 Jul 2021 20:30:15 +0000 Subject: [PATCH 13/22] Added detection testing service results inPrint Spooler Adding A Printer Driver From 2029cf855f5ebad2ed1b7748e0b6c29271dd599b Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 15:00:26 -0600 Subject: [PATCH 14/22] Update spoolsv_spawning_rundll32.yml --- detections/endpoint/spoolsv_spawning_rundll32.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 21c60bc0eb..935660ce5a 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -71,4 +71,4 @@ tags: type: Process Name role: - Child Process - automated_detection_testing: passed + automated_detection_testing: passed \ No newline at end of file From 63bdd403b01c399613a3526578186bd4eec763de Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Thu, 1 Jul 2021 15:14:22 -0600 Subject: [PATCH 15/22] Update printnightmare_cve_2021_1675.yml --- stories/printnightmare_cve_2021_1675.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/stories/printnightmare_cve_2021_1675.yml b/stories/printnightmare_cve_2021_1675.yml index d623cad193..b6a0d91fd9 100644 --- a/stories/printnightmare_cve_2021_1675.yml +++ b/stories/printnightmare_cve_2021_1675.yml @@ -5,11 +5,17 @@ date: '2021-07-01' author: Splunk Threat Research Team type: batch description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. -narrative: 'This analytic story identifies a recent critical vulnerability in the Windows Print Spooling service - CVE-2021-1675. Proof of concept code has been released publicly, but a thorough patch has not. \ +narrative: 'This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \ - Typical behavior of `spoolsv.exe` may exhibit spawning child processes and writing files to disk. This behavior, through public POC code, we have identified `spoolsv.exe` writing DLLs to specific paths. Also, content has been generated related to Print Spooler logs - EventCode 316, 808 and 4909. Not all PrintService logging is enabled by default and will require enabling it on critical or all systems. \ + The prerequisites for successful exploitation consist of: \ - In addition to ensuring logging and visibility is present, to exploit this vulnerability, the adversary will need access to the environment, the payload on disk, SMB share, and use of credentials to spread.' + 1. Print Spooler service enabled on the target system \ + + 1. Network connectivity to the target system (initial access has been obtained) \ + + 1. Hash or password for a low privileged user ( or computer ) account. \ + + In the most impactful scenario, an attacker would be able to leverage this vulnerability to obtain a SYSTEM shell on a domain controller and so escalate their privileges from a low privileged domain account to full domain access in the target environment as shown below.' references: - https://github.com/cube0x0/CVE-2021-1675/ - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/ From 237803358b7082899de8088220d0766a6e657e74 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 1 Jul 2021 16:22:54 -0500 Subject: [PATCH 16/22] updated spl and rba tags --- .../print_spooler_adding_a_printer_driver.yml | 9 +++++--- ...print_spooler_failed_to_load_a_plug_in.yml | 15 +++++++------ .../endpoint/spoolsv_spawning_rundll32.yml | 19 ++++++++++------- .../spoolsv_suspicious_loaded_modules.yml | 18 +++++++++------- .../spoolsv_suspicious_process_access.yml | 21 ++++++++++--------- detections/endpoint/spoolsv_writing_a_dll.yml | 13 ++++++------ .../spoolsv_writing_a_dll___sysmon.yml | 14 +++++++------ 7 files changed, 60 insertions(+), 49 deletions(-) diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 348e5cc6d8..68ed7f03b6 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -2,7 +2,7 @@ name: Print Spooler Adding A Printer Driver id: 313681a2-da8e-11eb-adad-acde48001122 version: 1 date: '2021-07-01' -author: Splunk Threat Research Team +author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint @@ -54,8 +54,11 @@ tags: confidence: 90 risk_score: 72 context: - - Source: Endpoint - - Stage: Persistence, Privilege Escalation, Defense Evasion + - Source:Endpoint + - Stage:Persistence, + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Incoming message: Suspicious print driver was loaded on endpoint $ComputerName$. observable: - name: ComputerName diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 626dd70d3b..0d6129d6a9 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -2,7 +2,7 @@ name: Print Spooler Failed to Load a Plug-in id: 1adc9548-da7c-11eb-8f13-acde48001122 version: 1 date: '2021-07-01' -author: Splunk Threat Research Team +author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint @@ -48,15 +48,14 @@ tags: # (impact * confidence)/100 risk_score: 72 context: - - Source: Endpoint - - Stage: Persistence, Privilege Escalation, Defense Evasion + - Source:Endpoint + - Stage:Persistence, + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Incoming message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. observable: - name: ComputerName type: Endpoint role: - - Victim - - name: EventCode - type: Other - role: - - Other \ No newline at end of file + - Victim \ No newline at end of file diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 21c60bc0eb..9dddc94e38 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -2,7 +2,7 @@ name: Spoolsv Spawning Rundll32 id: 15d905f6-da6b-11eb-ab82-acde48001122 version: 1 date: '2021-07-01' -author: Splunk Threat Research Team +author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint @@ -54,21 +54,24 @@ tags: confidence: 90 risk_score: 72 context: - - Source: Endpoint - - Stage: Privilege Escalation, Defense Evasion + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Local message: $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. observable: - - name: ComputerName + - name: dest type: Endpoint role: - Victim - - name: parent_process - type: Process Name + - name: parent_process_id + type: Process role: - Parent Process - - name: process_name - type: Process Name + - Attacker + - name: process_id + type: Process role: - Child Process automated_detection_testing: passed diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 852b789327..72aadf7c3f 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -2,7 +2,7 @@ name: Spoolsv Suspicious Loaded Modules id: a5e451f8-da81-11eb-b245-acde48001122 version: 1 date: '2021-07-01' -author: Splunk Threat Research Team +author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint @@ -11,8 +11,7 @@ description: This search is to detect suspicious loading of dll in specific path made by spoolsv.exe after the exploitation. search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) - as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer - EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you @@ -42,21 +41,24 @@ tags: confidence: 90 risk_score: 72 context: - - Source: Endpoint - - Stage: Privilege Escalation, Defense Evasion - message: $Image$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Local + message: $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. observable: - name: Computer type: Endpoint role: - Victim - - name: Image + - name: process_id type: Process Name role: - Parent Process + - Attacker - name: ImageLoaded - type: Location + type: File role: - Other automated_detection_testing: passed diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index 5a401e59e3..b474c07be5 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -2,7 +2,7 @@ name: Spoolsv Suspicious Process Access id: 799b606e-da81-11eb-93f8-acde48001122 version: 1 date: '2021-07-01' -author: Splunk Threat Research Team +author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint @@ -14,7 +14,7 @@ description: This analytic identifies a suspicious behavior related to PrintNigh search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage - TargetImage GrantedAccess CallTrace EventCode | `security_content_ctime(firstTime)` + TargetImage GrantedAccess CallTrace EventCode ProcessID| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and @@ -49,23 +49,24 @@ tags: confidence: 90 risk_score: 72 context: - - Source: Endpoint - - Stage: Privilege Escalation, Defense Evasion - message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint - $Computer$. This behavior is suspicious and related to PrintNightmare. + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Local + message: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. observable: - name: Computer type: Endpoint role: - Victim - - name: SourceImage - type: Process Name + - name: ProcessID + type: Process role: - - Process + - Parent Process - name: TargetImage type: Process Name role: - - Process + - Target automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 097fa06e9d..31c506c5bd 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -2,7 +2,7 @@ name: Spoolsv Writing a DLL id: d5bf5cf2-da71-11eb-92c2-acde48001122 version: 1 date: '2021-07-01' -author: Splunk Threat Research Team +author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint @@ -59,8 +59,9 @@ tags: confidence: 90 risk_score: 72 context: - - Source: Endpoint - - Stage: Privilege Escalation, Defense Evasion + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Defense Evasion message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. observable: @@ -68,12 +69,12 @@ tags: type: Endpoint role: - Victim - - name: process_name - type: Process Name + - name: process_id + type: Process role: - Process - name: file_path - type: Location + type: File role: - Other automated_detection_testing: passed diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 93d563a8ab..72dcb79d18 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -2,7 +2,7 @@ name: Spoolsv Writing a DLL - Sysmon id: 347fd388-da87-11eb-836d-acde48001122 version: 1 date: '2021-07-01' -author: Splunk Threat Research Team +author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint @@ -52,8 +52,10 @@ tags: confidence: 90 risk_score: 72 context: - - Source: Endpoint - - Stage: Privilege Escalation, Defense Evasion + - Source:Endpoint + - Stage:Privilege Escalation + - Stage:Defense Evasion + - Scope:Local message: $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. observable: @@ -61,12 +63,12 @@ tags: type: Endpoint role: - Victim - - name: process_name - type: Process Name + - name: process_id + type: Process role: - Process - name: file_path - type: Location + type: File role: - Other automated_detection_testing: passed From 6f29b8877ad7638109f4aa79f2271f0f0bd59a8c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 1 Jul 2021 16:26:42 -0500 Subject: [PATCH 17/22] adding process_id to spl --- detections/endpoint/spoolsv_writing_a_dll___sysmon.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 72dcb79d18..7be81ebf9f 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -14,7 +14,7 @@ description: The following analytic identifies a `.dll` being written by `spools any additional file modification events. search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*" file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by - dest, UserID, process_name, file_path, file_name, TargetFilename | `security_content_ctime(firstTime)` + dest, UserID, process_name, file_path, file_name, TargetFilename, process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your From 2f74506fc0bb0429b07f4bc74d92c3676e676a8f Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 2 Jul 2021 14:02:31 +0200 Subject: [PATCH 18/22] minor update --- .../print_spooler_adding_a_printer_driver.yml | 4 ++-- .../print_spooler_failed_to_load_a_plug_in.yml | 2 +- detections/endpoint/spoolsv_spawning_rundll32.yml | 2 +- .../endpoint/spoolsv_suspicious_loaded_modules.yml | 4 ++-- .../endpoint/spoolsv_suspicious_process_access.yml | 4 ++-- detections/endpoint/spoolsv_writing_a_dll.yml | 2 +- .../endpoint/spoolsv_writing_a_dll___sysmon.yml | 2 +- ...cious_rundll32_with_no_command_line_arguments.yml | 2 +- ...21_1675.yml => printnightmare_cve_2021_34527.yml} | 6 +++--- tests/endpoint/wsreset_uac_bypass.test.yml | 12 ++++++++++++ 10 files changed, 26 insertions(+), 14 deletions(-) rename stories/{printnightmare_cve_2021_1675.yml => printnightmare_cve_2021_34527.yml} (90%) create mode 100644 tests/endpoint/wsreset_uac_bypass.test.yml diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 68ed7f03b6..6da49ce7b9 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -2,7 +2,7 @@ name: Print Spooler Adding A Printer Driver id: 313681a2-da8e-11eb-adad-acde48001122 version: 1 date: '2021-07-01' -author: Mauricio Velazco, Michael Haag, Splunk +author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: batch datamodel: - Endpoint @@ -32,7 +32,7 @@ references: - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_operational.log kill_chain_phases: diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 0d6129d6a9..f4484bfc2d 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -26,7 +26,7 @@ references: - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 dataset: [] kill_chain_phases: - Exploitation diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 2711fbe013..0ec9f0d06d 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -29,7 +29,7 @@ references: - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 72aadf7c3f..1f4656418f 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -2,7 +2,7 @@ name: Spoolsv Suspicious Loaded Modules id: a5e451f8-da81-11eb-b245-acde48001122 version: 1 date: '2021-07-01' -author: Mauricio Velazco, Michael Haag, Splunk +author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: batch datamodel: - Endpoint @@ -21,7 +21,7 @@ references: - https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index b474c07be5..29af8e795f 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -2,7 +2,7 @@ name: Spoolsv Suspicious Process Access id: 799b606e-da81-11eb-93f8-acde48001122 version: 1 date: '2021-07-01' -author: Mauricio Velazco, Michael Haag, Splunk +author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: batch datamodel: - Endpoint @@ -28,7 +28,7 @@ references: - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 31c506c5bd..8c70dcc8f4 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -33,7 +33,7 @@ references: - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 7be81ebf9f..0a8501cf42 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -28,7 +28,7 @@ references: - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-sysmon.log kill_chain_phases: diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index ccb1421e3d..d6b7327a87 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -31,7 +31,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Cobalt Strike - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/stories/printnightmare_cve_2021_1675.yml b/stories/printnightmare_cve_2021_34527.yml similarity index 90% rename from stories/printnightmare_cve_2021_1675.yml rename to stories/printnightmare_cve_2021_34527.yml index b6a0d91fd9..b9b52925ef 100644 --- a/stories/printnightmare_cve_2021_1675.yml +++ b/stories/printnightmare_cve_2021_34527.yml @@ -1,10 +1,10 @@ -name: PrintNightmare CVE-2021-1675 +name: PrintNightmare CVE-2021-34527 id: fd79470a-da88-11eb-b803-acde48001122 version: 1 date: '2021-07-01' author: Splunk Threat Research Team type: batch -description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. +description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. narrative: 'This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \ The prerequisites for successful exploitation consist of: \ @@ -23,7 +23,7 @@ references: - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes tags: analytic_story: - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 category: - Lateral Movement - Privilege Escalation diff --git a/tests/endpoint/wsreset_uac_bypass.test.yml b/tests/endpoint/wsreset_uac_bypass.test.yml new file mode 100644 index 0000000000..b615fc3819 --- /dev/null +++ b/tests/endpoint/wsreset_uac_bypass.test.yml @@ -0,0 +1,12 @@ +name: WSReset UAC Bypass Unit Test +tests: +- name: WSReset UAC Bypass + file: detections/endpoint/wsreset_uac_bypass.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 30af993c48193ed27dd8cffe4a6757f6db811267 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 2 Jul 2021 14:03:53 +0200 Subject: [PATCH 19/22] Delete wsreset_uac_bypass.test.yml --- tests/endpoint/wsreset_uac_bypass.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/wsreset_uac_bypass.test.yml diff --git a/tests/endpoint/wsreset_uac_bypass.test.yml b/tests/endpoint/wsreset_uac_bypass.test.yml deleted file mode 100644 index b615fc3819..0000000000 --- a/tests/endpoint/wsreset_uac_bypass.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: WSReset UAC Bypass Unit Test -tests: -- name: WSReset UAC Bypass - file: detections/endpoint/wsreset_uac_bypass.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file From 2c948c99671a6786d0e2d11fe7704ea19e457e42 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 2 Jul 2021 14:09:14 +0200 Subject: [PATCH 20/22] minor update2 --- detections/endpoint/print_spooler_adding_a_printer_driver.yml | 2 +- detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml | 2 +- .../rundll32_with_no_command_line_arguments_with_network.yml | 2 +- detections/endpoint/spoolsv_spawning_rundll32.yml | 2 +- detections/endpoint/spoolsv_suspicious_process_access.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 6da49ce7b9..7b07d6e85f 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: 'The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified - during our testing of CVE-2021-1675 or PrintNightmare. \ + during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following event will occur - "Printer driver 1234 for Windows x64 Version-3 was added or updated. Files:- UNIDRV.DLL, kernelbase.dll, diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index f4484bfc2d..8c3d93a30f 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -6,7 +6,7 @@ author: Mauricio Velazco, Michael Haag, Splunk type: batch datamodel: - Endpoint -description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-1675 or PrintNightmare. \ +description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ Within the proof of concept code, the following error will occur - "The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\meterpreter.dll, error code 0x45A. See the event user data for context information." \ diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index e101b0387f..1108290993 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -36,7 +36,7 @@ tags: analytic_story: - Suspicious Rundll32 Activity - Cobalt Strike - - PrintNightmare CVE-2021-1675 + - PrintNightmare CVE-2021-34527 automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 0ec9f0d06d..71faff5d32 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint description: The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified - during our testing of CVE-2021-1675 or PrintNightmare. Typically, this is not normal + during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During triage, isolate the endpoint and review for source of exploitation. Capture any additional file modification events. diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index 29af8e795f..f19cfdcb05 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -7,7 +7,7 @@ type: batch datamodel: - Endpoint description: This analytic identifies a suspicious behavior related to PrintNightmare, - or CVE-2021-1675, to gain privilege escalation on the vulnerable machine. This + or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability to elevate privilege. This detection is to look for suspicious process access made by the spoolsv.exe that may related to the attack. From dc0eac261d71d3c8d288d118fd61102c2ee04309 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 2 Jul 2021 14:38:44 +0200 Subject: [PATCH 21/22] minor update3 --- detections/endpoint/spoolsv_writing_a_dll.yml | 2 +- detections/endpoint/spoolsv_writing_a_dll___sysmon.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 8c70dcc8f4..32f0c01708 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -7,7 +7,7 @@ type: batch datamodel: - Endpoint description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. - This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, + This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 0a8501cf42..d08620f6d5 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -7,7 +7,7 @@ type: batch datamodel: - Endpoint description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. - This was identified during our testing of CVE-2021-1675 or PrintNightmare. Typically, + This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write a `.dll`. Current POC code used will write the suspicious DLL to disk within a path of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source of exploitation. Capture From 7ce88879d67118f25e965a05eb271be2765a3667 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Fri, 2 Jul 2021 11:03:08 -0400 Subject: [PATCH 22/22] fixing type yep yep --- .../endpoint/print_spooler_failed_to_load_a_plug_in.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 8c3d93a30f..2bb02a1abc 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -56,6 +56,6 @@ tags: message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. observable: - name: ComputerName - type: Endpoint + type: Hostname role: - - Victim \ No newline at end of file + - Victim