title: SystemNightmare Exploitation Script Execution
ruletype: Sigma
author: Florian Roth
date: 2021/08/11
description: Detects the exploitation of PrinterNightmare to get a shell as LOCAL_SYSTEM
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine:
    - '*printnightmare.gentilkiwi.com*'
    - '* /user:gentilguest *'
    - '*Kiwi Legit Printer*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Unknown
id: c01f7bd6-0c1d-47aa-9c61-187b91273a16
level: critical
logsource:
  category: process_creation
  product: windows
references:
- https://github.com/GossiTheDog/SystemNightmare
status: experimental
tags:
- attack.privilege_escalation
- attack.t1068