Potential PrintNightmare Exploitation Detected

karim gi@kappanello

•updated Mar 10, 2026•7•0•84

Detects potential exploitation of CVE-2021-1675 / CVE-2021-34527 (PrintNightmare) via anomalous SMB access to the IPC$ share targeting the "spoolss" named pipe (AccessMask: 0x3). This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.