Remote Printing Service Abuse for Lateral Movement

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•23

This rule detects remote procedure call (RPC) activity related to the Print System Remote Protocol (MS-RPRN) and Print System Asynchronous Remote Protocol (MS-PAR) interfaces. Specifically, it looks for RPC Firewall events (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches known UUIDs associated with these printing protocols. This activity can indicate an attempt to abuse remote printing services for lateral movement within a network, potentially exploiting vulnerabilities like CVE-2021-34527 (PrintNightmare).