Possible PrintNightmare Print Driver Installation via RPC

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•31

Detects the remote installation of a print driver, which is a possible indication of the exploitation of PrintNightmare (CVE-2021-1675, CVE-2021-34527). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally or through group policy.