CVE-2021-1675 Print Spooler Exploitation via IPC Share Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•4•0•55

Detects remote printer driver load from a Detailed File Share event in Windows Security logs, which is indicative of successful exploitation attempts against the Print Spooler vulnerabilities CVE-2021-1675 (PrintNightmare) and CVE-2021-34527.