PrintNightmare SMB Exploit Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to exploit the PrintNightmare vulnerability over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "spoolss" and "RpcAddPrinterDriverEx" in a case-insensitive manner, indicating an attempt to leverage the Print Spooler service for privilege escalation.