
title: PrinterNightmare Mimimkatz Driver Name
author: Markus Neis, @markus_neis, Florian Roth
date: 2021/07/04
description: Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited
  in CVE-2021-1675 and CVE-2021-34527
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_10:
    TargetObject:
    - '*\Control\Print\Environments*'
    - '*\CurrentVersion\Print\Printers*'
  SELECTION_11:
    TargetObject:
    - '*Gentil Kiwi*'
    - '*mimikatz printer*'
    - '*Kiwi Legit Printer*'
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject:
    - '*\Control\Print\Environments\Windows x64\Drivers\Version-3\QMS 810\\*'
    - '*\Control\Print\Environments\Windows x64\Drivers\Version-3\mimikatz*'
  SELECTION_5:
    TargetObject: '*legitprinter*'
  SELECTION_6:
    TargetObject: '*\Control\Print\Environments\Windows*'
  SELECTION_7:
    EventID: 12
  SELECTION_8:
    EventID: 13
  SELECTION_9:
    EventID: 14
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and ((SELECTION_4 or (SELECTION_5
    and SELECTION_6)) or ((SELECTION_7 or SELECTION_8 or SELECTION_9) and SELECTION_10
    and SELECTION_11)))
falsepositives:
- Legitimate installation of printer driver QMS 810, Texas Instruments microLaser
  printer (unlikely)
id: ba6b9e43-1d45-4d3c-a504-1043a64c8469
level: critical
logsource:
  category: registry_event
  product: windows
modified: 2021/07/28
references:
- https://github.com/gentilkiwi/mimikatz/commit/c21276072b3f2a47a21e215a46962a17d54b3760
- https://www.lexjansen.com/sesug/1993/SESUG93035.pdf
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913
status: experimental
tags:
- attack.execution
- attack.t1204
- cve.2021.1675
- cve.2021.34527
ruletype: SIGMA
