Potential SystemNightmare Exploitation Attempt

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•20

Detects an exploitation attempt of the SystemNightmare vulnerability, which aims to obtain a shell with LOCAL_SYSTEM privileges. The rule specifically looks for command-line arguments associated with known exploitation tools or techniques related to SystemNightmare, such as references to 'printnightmare.gentilkiwi.com', '/user:gentilguest', or 'Kiwi Legit Printer'.