Anvilogic high experimental spl

Additional dll added to Spool Driver [splunk-sysmon]

This use case look for an additional dll to the print drivers as seen with Print Nightmare CVE-2021-1675. -- Threat Actor Association: Earth Lusca, Vice Society - Software Association: Black Basta, Play, Ransom Cartel

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=11 
OR "<EventID>11<" 
OR "<EventID>23<" 
OR EventCode=23) "spoolsv.exe" "dll")
| regex TargetFilename="\QC:\Windows\System32\spool\drivers\x64\E"
| table _time, host, user, signature_id, process, process_*, parent_*
| bin span=5s
| stats values(*) as * by _time, host, process_path
| where match(signature_id, "11") and match(signature_id, "23")

Field Validations

Loading…

Comments (0)

Loading comments...