Suspicious Print Spooler Point and Print DLL

 1[metadata]
 2creation_date = "2020/11/26"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/03/28"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service.
13Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as
14SYSTEM.
15"""
16from = "now-9m"
17index = ["logs-endpoint.events.registry-*", "endgame-*", "logs-windows.sysmon_operational-*"]
18language = "eql"
19license = "Elastic License v2"
20name = "Suspicious Print Spooler Point and Print DLL"
21references = [
22    "https://www.accenture.com/us-en/blogs/cyber-defense/discovering-exploiting-shutting-down-dangerous-windows-print-spooler-vulnerability",
23    "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Privilege%20Escalation/privesc_sysmon_cve_20201030_spooler.evtx",
24    "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1030",
25]
26risk_score = 73
27rule_id = "bd7eefee-f671-494e-98df-f01daf9e5f17"
28severity = "high"
29tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation", "Data Source: Elastic Endgame", "Use Case: Vulnerability", "Data Source: Elastic Defend", "Data Source: Sysmon"]
30type = "eql"
31
32query = '''
33sequence by host.id with maxspan=30s
34[registry where host.os.type == "windows" and
35 registry.path : (
36    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory",
37    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory"
38    ) and
39 registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4"]
40[registry where host.os.type == "windows" and
41 registry.path : (
42    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module",
43    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module"
44    ) and
45 registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4\\*"]
46'''
47
48
49[[rule.threat]]
50framework = "MITRE ATT&CK"
51[[rule.threat.technique]]
52id = "T1068"
53name = "Exploitation for Privilege Escalation"
54reference = "https://attack.mitre.org/techniques/T1068/"
55
56
57[rule.threat.tactic]
58id = "TA0004"
59name = "Privilege Escalation"
60reference = "https://attack.mitre.org/tactics/TA0004/"