CVE-2021-1675 Print Spooler Exploitation Filename Pattern

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•1•0•38

Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.