
title: CVE-2021-1675 Print Spooler Exploitation IPC Access
author: INIT_6
date: 2021/07/02
description: Detects remote printer driver load from Detailed File Share in Security
  logs that are a sign of successful exploitation attempts against print spooler vulnerability
  CVE-2021-1675 and CVE-2021-34527
detection:
  SELECTION_1:
    EventID: '5145'
  SELECTION_2:
    ShareName: \\\*\IPC$
  SELECTION_3:
    RelativeTargetName: spoolss
  SELECTION_4:
    AccessMask: '0x3'
  SELECTION_5:
    ObjectType: File
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4 and SELECTION_5)
falsepositives:
- nothing observed so far
id: 8fe1c584-ee61-444b-be21-e9054b229694
level: critical
logsource:
  product: windows
  service: security
references:
- https://twitter.com/INIT_3/status/1410662463641731075
status: experimental
tags:
- attack.execution
- attack.t1569
- cve.2021.1675
- cve.2021.34527
ruletype: SIGMA
