
title: CVE-2021-1675 Print Spooler Exploitation
author: Florian Roth
date: 2021/07/01
description: Detects driver load events print service operational log that are a sign
  of successful exploitation attempts against print spooler vulnerability CVE-2021-1675
detection:
  SELECTION_1:
    EventID: '316'
  SELECTION_2:
  - 'UNIDRV.DLL, kernelbase.dll, '
  - ' 123 '
  - ' 1234 '
  - mimispool
  condition: (SELECTION_1 and (SELECTION_2))
falsepositives:
- Unknown
fields:
- DriverAdded
id: f34d942d-c8c4-4f1f-b196-22471aecf10a
level: critical
logsource:
  product: windows
  service: printservice-operational
references:
- https://twitter.com/MalwareJake/status/1410421967463731200
status: experimental
tags:
- attack.execution
- attack.t1569
- cve.2021.1675
ruletype: SIGMA
