cve.2021-34527

Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection

Nov 10, 2025 · attack.defense-evasion attack.privilege-escalation attack.t1055 detection.emerging-threats cve.2021-34527 cve.2021-1675 ·

Share on:

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

Possible PrintNightmare Print Driver Install - CVE-2021-1675

Nov 10, 2025 · attack.execution cve.2021-1678 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·

Share on:

Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.

PrinterNightmare Mimikatz Driver Name

Nov 10, 2025 · attack.execution attack.t1204 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·

Share on:

Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527

Windows Spooler Service Suspicious Binary Load

Nov 10, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·

Share on:

Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).

CVE-2021-1675 Print Spooler Exploitation IPC Access

Aug 12, 2024 · attack.execution attack.t1569 cve.2021-1675 cve.2021-34527 detection.emerging-threats ·

Share on:

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527