CVE-2021-34527 | CVE-2021-1675 - PrintNightmare

**The playbook can be triggered manually or automatically by setting up a reoccurring job.** Microsoft has released a security update in June 2021 Patch Tuesday for CVE-2021-1675, a Local Privilege Escalation vulnerability in the Print Spooler Service. Later that month, researchers found another method to exploit the Print Spooler service remotely, which raised the severity of the vulnerability due to the fact that the new method allows Remote Code Execution, a new ID was given to the critical vulnerability - CVE-2021-34527. Microsoft patched the vulnerability in June but an exploit POC and complete technical analysis were made publicly available online. **Update 7.8.2021 - Microsoft has released an emergency patch for the PrintNightmare. A reference for the patch can be found in "Install Microsoft spooler service patches" task. This playbook includes the following tasks: - Manual actions to mitigate the exploit - Search Vulnerable Devices using the CVE - Query SIEM, FW, XDR to detect malicious activity and compromised hosts - Run Dedicated Detection and Response playbook for Cortex XDR More details on the vulnerabilities: [CVE-2021-1675 LPE](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) [CVE-2021-34527 RCE](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Rapid Breach Response · 35 tasks · 3 inputs · 0 outputs

Inputs

  • CVE — PrintNightmare CVEs
  • SplunkEarliestTime — The earliest time for the Splunk search query.
  • SplunkLatestTime — The latest time for the Splunk search query.

Commands used

closeInvestigation splunk-search

Flowchart

Qradar Splunk No Yes Start Start Run vulnerability scan Run vulnerability scan Vulnerability Scan Vulnerability Scan Search Endpoint by CVE - Generic - Search Endpoint by CVE - Generic Search Endpoint by CVE - ... Search Endpoint by CVE - Generic Splunk Splunk Qradar Qradar Manually Hunt Windows Event Logs Manually Hunt Windows Eve... Is SIEM enabled? Is SIEM enabled? Search for suspicious Print Spooler and SMB Event IDs - splunk-search Search for suspicious Pri... splunk-search Search for suspicious Print Spooler Event IDs - QRadarFullSearch Search for suspicious Pri... QRadarFullSearch Search for suspicious SMB Event ID - QRadarFullSearch Search for suspicious SMB... QRadarFullSearch Search for event IDs 808, 316 and 31017 Search for event IDs 808,... CVE Mitigations CVE Mitigations Done Done Panorama Query Logs for PrintNightmare Threat IDs - Panorama Query Logs Panorama Query Logs for P... Panorama Query Logs Search for suspicious registry modification by Spoolsv - QRadarFullSearch Search for suspicious reg... QRadarFullSearch Search for Spoolsv Suspicious Loaded Modules - splunk-search Search for Spoolsv Suspic... splunk-search Search for Spoolsv Suspicious Process Access - splunk-search Search for Spoolsv Suspic... splunk-search Search for suspicious Spoolsv Spawning Rundll32 - splunk-search Search for suspicious Spo... splunk-search Analysis resolution - Should continue with the investigation? Analysis resolution - Sho... Investigate Further Investigate Further Close Investigation - closeInvestigation Close Investigation closeInvestigation Search for suspicious Spoolsv Spawning Rundll32 Search for suspicious Spo... Search for Spoolsv Suspicious Process Access Search for Spoolsv Suspic... Search for Spoolsv Suspicious Loaded Modules Search for Spoolsv Suspic... Install Microsoft spooler service patches Install Microsoft spooler... Disable Print Spooler service Disable Print Spooler ser... Restricting the ACLs Restricting the ACLs Disable Print Spooler Service Point and Print Disable Print Spooler Ser... Resolution Resolution SIEM Hunting SIEM Hunting Vulnerabilities Hunting Vulnerabilities Hunting Panorama Hunting Panorama Hunting Cortex XDR Cortex XDR Cortex XDR - PrintNightmare Detection and Response - Cortex XDR - PrintNightmare Detection and Response Cortex XDR - PrintNightma... Cortex XDR - PrintNightmare D...