CVE-2021-1675 Print Spooler Exploitation Attempt
This rule detects attempts to exploit the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. It specifically looks for Event ID 316 in the Print Service Operational log, which indicates a driver load event. The rule further refines detection by searching for keywords such as 'UNIDRV.DLL, kernelbase.dll,', '123', '1234', or 'mimispool', which are associated with known exploitation methods for this vulnerability. Successful exploitation often involves loading malicious drivers or DLLs through the print spooler service.
Sigma
