Suspicious Print Spooler Point and Print DLL

  1[metadata]
  2creation_date = "2020/11/26"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2025/01/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service.
 13Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as
 14SYSTEM.
 15"""
 16from = "now-9m"
 17index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*", "winlogbeat-*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Suspicious Print Spooler Point and Print DLL"
 21references = [
 22    "https://www.accenture.com/us-en/blogs/cyber-defense/discovering-exploiting-shutting-down-dangerous-windows-print-spooler-vulnerability",
 23    "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Privilege%20Escalation/privesc_sysmon_cve_20201030_spooler.evtx",
 24    "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1030",
 25]
 26risk_score = 73
 27rule_id = "bd7eefee-f671-494e-98df-f01daf9e5f17"
 28severity = "high"
 29tags = [
 30    "Domain: Endpoint",
 31    "OS: Windows",
 32    "Use Case: Threat Detection",
 33    "Tactic: Privilege Escalation",
 34    "Data Source: Elastic Endgame",
 35    "Use Case: Vulnerability",
 36    "Data Source: Elastic Defend",
 37    "Data Source: Sysmon",
 38    "Resources: Investigation Guide",
 39]
 40type = "eql"
 41
 42query = '''
 43sequence by host.id with maxspan=30s
 44[registry where host.os.type == "windows" and
 45 registry.path : (
 46    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory",
 47    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory"
 48    ) and
 49 registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4"]
 50[registry where host.os.type == "windows" and
 51 registry.path : (
 52    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module",
 53    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module"
 54    ) and
 55 registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4\\*"]
 56'''
 57note = """## Triage and analysis
 58
 59> **Disclaimer**:
 60> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 61
 62### Investigating Suspicious Print Spooler Point and Print DLL
 63
 64The Windows Print Spooler service manages print jobs and is integral to printing operations. Adversaries exploit vulnerabilities like CVE-2020-1030 to escalate privileges by loading malicious DLLs into the spooler process, which runs with SYSTEM-level permissions. The detection rule identifies suspicious registry modifications linked to the Print Spooler, indicating potential exploitation attempts by monitoring specific registry paths and data patterns.
 65
 66### Possible investigation steps
 67
 68- Review the registry paths specified in the alert to confirm any unauthorized modifications, focusing on the paths: HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory and HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module.
 69- Check the registry data strings for any unexpected or suspicious DLLs located in C:\\Windows\\System32\\spool\\drivers\\x64\\4, which may indicate a malicious payload.
 70- Investigate the host identified by host.id to determine if there are any other signs of compromise or unusual activity, such as unexpected processes or network connections.
 71- Correlate the alert with other security events or logs from the same host to identify any related activities or patterns that could suggest a broader attack.
 72- Assess the system's patch level and update status to ensure that all known vulnerabilities, including CVE-2020-1030, have been addressed and mitigated.
 73- If a malicious DLL is confirmed, isolate the affected system to prevent further exploitation and begin remediation efforts, such as removing the malicious files and restoring the system to a known good state.
 74
 75### False positive analysis
 76
 77- Legitimate printer driver updates or installations may trigger the rule due to registry modifications in the specified paths. Users can create exceptions for known and trusted driver update processes to prevent false alerts.
 78- Custom print configurations by IT departments that modify the SpoolDirectory or CopyFiles registry paths might be flagged. Document and exclude these configurations if they are verified as safe and necessary for business operations.
 79- Automated scripts or software that manage printer settings and inadvertently modify the monitored registry paths can cause false positives. Identify and whitelist these scripts or applications after confirming their legitimacy.
 80- Third-party print management solutions that interact with the Print Spooler service may lead to false detections. Evaluate these solutions and exclude their known benign activities from the detection rule.
 81
 82### Response and remediation
 83
 84- Immediately isolate the affected system from the network to prevent further exploitation or lateral movement by the adversary.
 85- Terminate the Print Spooler service on the compromised system to stop any ongoing malicious activity and prevent further DLL loading.
 86- Conduct a thorough scan of the system using updated antivirus and anti-malware tools to identify and remove any malicious DLLs or related files.
 87- Review and restore the registry paths identified in the detection query to their default values to ensure no malicious configurations remain.
 88- Apply the latest security patches and updates from Microsoft to address CVE-2020-1030 and other known vulnerabilities in the Print Spooler service.
 89- Monitor the network for any signs of similar exploitation attempts, focusing on the registry paths and data patterns specified in the detection rule.
 90- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the potential impact on other systems within the network."""
 91
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1068"
 97name = "Exploitation for Privilege Escalation"
 98reference = "https://attack.mitre.org/techniques/T1068/"
 99
100
101[rule.threat.tactic]
102id = "TA0004"
103name = "Privilege Escalation"
104reference = "https://attack.mitre.org/tactics/TA0004/"