Anvilogic high experimental spl

Additional dll added to Spool Driver [splunk-winevent]

This use case look for an additional dll to the print drivers as seen with Print Nightmare CVE-2021-1675. -- Threat Actor Association: Earth Lusca, Vice Society - Software Association: Black Basta, Play, Ransom Cartel

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=316) 
OR "<EventID>316<") TERM(Printer) TERM(driver) TERM(added) TERM(updated)
| rex field=_raw max_match=0 "(?i)(?<driver>\S+.dll)"
| eval c_driver=mvcount(driver)
| table _time, host, user, signature_id, process, process_*, parent_*, signature, c_driver
| bin span=1s
| stats values(*) as * by _time, host
| where c_driver > 2

Field Validations

Loading…

Comments (0)

Loading comments...