
title: Windows Spooler Service Suspicious File Deletion
author: Bhabesh Raj
date: 2021/07/01
description: Detect DLL deletions from Spooler Service driver folder
detection:
  SELECTION_1:
    EventID: 23
  SELECTION_2:
    EventID: 26
  SELECTION_3:
    Image: '*spoolsv.exe'
  SELECTION_4:
    TargetFilename: '*C:\Windows\System32\spool\drivers\x64\3\\*'
  condition: ((SELECTION_1 or SELECTION_2) and SELECTION_3 and SELECTION_4)
falsepositives:
- Unknown
id: 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
level: high
logsource:
  category: file_delete
  product: windows
modified: 2021/08/24
references:
- https://github.com/hhlxf/PrintNightmare
- https://github.com/cube0x0/CVE-2021-1675
status: experimental
tags:
- attack.persistence
- attack.defense_evasion
- attack.privilege_escalation
- attack.t1574
- cve.2021.1675
ruletype: SIGMA
