Suspicious Printer Driver Empty Manufacturer

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects a suspicious printer driver installation where the 'Manufacturer' registry value is set to an empty string. This behavior can be indicative of malicious activity, potentially related to privilege escalation or defense evasion, as seen in some exploits like PrintNightmare (CVE-2021-1675).