CVE-2021-34527 | CVE-2021-1675 - PrintNightmare

**The playbook can be triggered manually or automatically by setting up a reoccurring job.** Microsoft has released a security update in June 2021 Patch Tuesday for CVE-2021-1675, a Local Privilege Escalation vulnerability in the Print Spooler Service. Later that month, researchers found another method to exploit the Print Spooler service remotely, which raised the severity of the vulnerability due to the fact that the new method allows Remote Code Execution, a new ID was given to the critical vulnerability - CVE-2021-34527. Microsoft patched the vulnerability in June but an exploit POC and complete technical analysis were made publicly available online. **Update 7.8.2021 - Microsoft has released an emergency patch for the PrintNightmare. A reference for the patch can be found in "Install Microsoft spooler service patches" task. This playbook includes the following tasks: - Manual actions to mitigate the exploit - Search Vulnerable Devices using the CVE - Query SIEM, FW, XDR to detect malicious activity and compromised hosts - Run Dedicated Detection and Response playbook for Cortex XDR More details on the vulnerabilities: [CVE-2021-1675 LPE](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) [CVE-2021-34527 RCE](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Rapid Breach Response · 35 tasks · 3 inputs · 0 outputs

Details

IDCVE-2021-1675 - PrintNightmare
From Version5.5.0
Tasks35

README

The playbook can be triggered manually or automatically by setting up a reoccurring job.

Microsoft has released a security update in June 2021 Patch Tuesday for CVE-2021-1675, a Local Privilege Escalation vulnerability in the Print Spooler Service. Later that month, researchers found another method to exploit the Print Spooler service remotely, which raised the severity of the vulnerability due to the fact that the new method allows Remote Code Execution, a new ID was given to the critical vulnerability - CVE-2021-34527.

Microsoft patched the vulnerability in June but an exploit POC and complete technical analysis were made publicly available online.

**Update 7.8.2021 - Microsoft has released an emergency patch for the PrintNightmare. A reference for the patch can be found in “Install Microsoft spooler service patches” task.

This playbook includes the following tasks:

  • Manual actions to mitigate the exploit
  • Search Vulnerable Devices using the CVE
  • Query SIEM, FW, XDR to detect malicious activity and compromised hosts
  • Run Dedicated Detection and Response playbook for Cortex XDR

More details on the vulnerabilities:
CVE-2021-1675 LPE
CVE-2021-34527 RCE

** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Cortex XDR - PrintNightmare Detection and Response
  • QRadarFullSearch
  • Search Endpoint by CVE - Generic
  • Panorama Query Logs

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

  • closeInvestigation
  • splunk-search

Playbook Inputs

Name Description Default Value Required
CVE PrintNightmare CVEs CVE-2021-1675,CVE-2021-34527 Optional
SplunkEarliestTime The earliest time for the Splunk search query. -30d Optional
SplunkLatestTime The latest time for the Splunk search query. now Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

CVE-2021-34527 | CVE-2021-1675 - PrintNightmare

Inputs

  • CVE — PrintNightmare CVEs
  • SplunkEarliestTime — The earliest time for the Splunk search query.
  • SplunkLatestTime — The latest time for the Splunk search query.

Commands used

closeInvestigation splunk-search

Flowchart

Qradar Splunk No Yes Start Start Run vulnerability scan Run vulnerability scan Vulnerability Scan Vulnerability Scan Search Endpoint by CVE - Generic - Search Endpoint by CVE - Generic Search Endpoint by CVE - ... Search Endpoint by CVE - Generic Splunk Splunk Qradar Qradar Manually Hunt Windows Event Logs Manually Hunt Windows Eve... Is SIEM enabled? Is SIEM enabled? Search for suspicious Print Spooler and SMB Event IDs - splunk-search Search for suspicious Pri... splunk-search Search for suspicious Print Spooler Event IDs - QRadarFullSearch Search for suspicious Pri... QRadarFullSearch Search for suspicious SMB Event ID - QRadarFullSearch Search for suspicious SMB... QRadarFullSearch Search for event IDs 808, 316 and 31017 Search for event IDs 808,... CVE Mitigations CVE Mitigations Done Done Panorama Query Logs for PrintNightmare Threat IDs - Panorama Query Logs Panorama Query Logs for P... Panorama Query Logs Search for suspicious registry modification by Spoolsv - QRadarFullSearch Search for suspicious reg... QRadarFullSearch Search for Spoolsv Suspicious Loaded Modules - splunk-search Search for Spoolsv Suspic... splunk-search Search for Spoolsv Suspicious Process Access - splunk-search Search for Spoolsv Suspic... splunk-search Search for suspicious Spoolsv Spawning Rundll32 - splunk-search Search for suspicious Spo... splunk-search Analysis resolution - Should continue with the investigation? Analysis resolution - Sho... Investigate Further Investigate Further Close Investigation - closeInvestigation Close Investigation closeInvestigation Search for suspicious Spoolsv Spawning Rundll32 Search for suspicious Spo... Search for Spoolsv Suspicious Process Access Search for Spoolsv Suspic... Search for Spoolsv Suspicious Loaded Modules Search for Spoolsv Suspic... Install Microsoft spooler service patches Install Microsoft spooler... Disable Print Spooler service Disable Print Spooler ser... Restricting the ACLs Restricting the ACLs Disable Print Spooler Service Point and Print Disable Print Spooler Ser... Resolution Resolution SIEM Hunting SIEM Hunting Vulnerabilities Hunting Vulnerabilities Hunting Panorama Hunting Panorama Hunting Cortex XDR Cortex XDR Cortex XDR - PrintNightmare Detection and Response - Cortex XDR - PrintNightmare Detection and Response Cortex XDR - PrintNightma... Cortex XDR - PrintNightmare D...

Source

playbook-CVE-2021-1675_-_PrintNightmare.yml
Download History Raw 
id: CVE-2021-1675 - PrintNightmare
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: CVE-2021-34527 | CVE-2021-1675 - PrintNightmare
description: |-
  **The playbook can be triggered manually or automatically by setting up a reoccurring job.**

  Microsoft has released a security update in June 2021 Patch Tuesday for CVE-2021-1675, a Local Privilege Escalation vulnerability in the Print Spooler Service. Later that month, researchers found another method to exploit the Print Spooler service remotely, which raised the severity of the vulnerability due to the fact that the new method allows Remote Code Execution, a new ID was given to the critical vulnerability - CVE-2021-34527.

  Microsoft patched the vulnerability in June but an exploit POC and complete technical analysis were made publicly available online.

  **Update 7.8.2021 - Microsoft has released an emergency patch for the PrintNightmare. A reference for the patch can be found in "Install Microsoft spooler service patches" task.

  This playbook includes the following tasks:
  - Manual actions to mitigate the exploit
  - Search Vulnerable Devices using the CVE
  - Query SIEM, FW, XDR to detect malicious activity and compromised hosts
  - Run Dedicated Detection and Response playbook for Cortex XDR

  More details on the vulnerabilities:
  [CVE-2021-1675 LPE](https://nvd.nist.gov/vuln/detail/CVE-2021-1675)
  [CVE-2021-34527 RCE](https://nvd.nist.gov/vuln/detail/CVE-2021-34527)

  ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: f1cfc2ee-24a8-469d-842d-be83b7dc2ca1
    type: start
    task:
      id: f1cfc2ee-24a8-469d-842d-be83b7dc2ca1
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "40"
      - "41"
      - "43"
      - "42"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 430,
          "y": 80
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: a26d7d7c-a25e-414b-83c8-8c00b2087390
    type: regular
    task:
      id: a26d7d7c-a25e-414b-83c8-8c00b2087390
      version: -1
      name: Run vulnerability scan
      description: |+
        Run a vulnerability scan to find vulnerable devices. Either by running PowerShell script or initiate a new scan with vulnerability scanner tool.

      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "39"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2830
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "6":
    id: "6"
    taskid: 0c90e265-d762-414e-8a33-d7eed8a9bd1d
    type: title
    task:
      id: 0c90e265-d762-414e-8a33-d7eed8a9bd1d
      version: -1
      name: Vulnerability Scan
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "2"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 2680
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "7":
    id: "7"
    taskid: 2a67bf0f-29f4-45ac-8634-8179c695e438
    type: playbook
    task:
      id: 2a67bf0f-29f4-45ac-8634-8179c695e438
      version: -1
      name: Search Endpoint by CVE - Generic
      playbookName: Search Endpoint by CVE - Generic
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      CVE_ID:
        complex:
          root: inputs.CVE
    separatecontext: false
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 920,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "9":
    id: "9"
    taskid: 21a9d6cc-f618-4656-85d9-a85ba15a4b76
    type: title
    task:
      id: 21a9d6cc-f618-4656-85d9-a85ba15a4b76
      version: -1
      name: Splunk
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "13"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 190,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: b0655aa0-9ac3-42eb-84e0-8ce440b9a142
    type: title
    task:
      id: b0655aa0-9ac3-42eb-84e0-8ce440b9a142
      version: -1
      name: Qradar
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "15"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -970,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: afeb0f51-42c5-4907-87bf-a8973e4ea518
    type: title
    task:
      id: afeb0f51-42c5-4907-87bf-a8973e4ea518
      version: -1
      name: 'Manually Hunt Windows Event Logs '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "17"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 910
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 7fa0b9d9-8a02-4d94-8e57-88369afe81e8
    type: condition
    task:
      id: 7fa0b9d9-8a02-4d94-8e57-88369afe81e8
      version: -1
      name: Is SIEM enabled?
      description: Returns 'yes' if integration brand is available. Otherwise returns
        'no'
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "11"
      Qradar:
      - "10"
      Splunk:
      - "9"
    separatecontext: false
    conditions:
    - label: Splunk
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: SplunkPy
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    - label: Qradar
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: QRadar_v2
                    ignorecase: true
                accessor: state
            iscontext: true
          right:
            value:
              simple: active
          ignorecase: true
    view: |-
      {
        "position": {
          "x": -380,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "13":
    id: "13"
    taskid: 6051b84a-2d2e-4726-860d-f65d1eb261d5
    type: regular
    task:
      id: 6051b84a-2d2e-4726-860d-f65d1eb261d5
      version: -1
      name: Search for suspicious Print Spooler and SMB Event IDs
      description: "Searches Splunk for Event IDs related to PrintNightmare vulnerability:\n\
        808 (Print Spooler) \n316 (Print Spooler) \n31017 (SMB)"
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "27"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      latest_time:
        complex:
          root: inputs.SplunkLatestTime
      query:
        simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode=
          808 OR EventCode=316 OR EventCode=31017
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "15":
    id: "15"
    taskid: ef8e40cb-46a1-42dd-84df-bd7cc8edbd03
    type: playbook
    task:
      id: ef8e40cb-46a1-42dd-84df-bd7cc8edbd03
      version: -1
      name: Search for suspicious Print Spooler Event IDs
      description: This playbook runs a QRadar query and return its results to the
        context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "16"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT UTF8(payload) as search_payload from events where LOGSOURCETYPENAME(devicetype)='Microsoft
          Windows Security Event Log' and LOGSOURCETYPENAME(devicetype)='Microsoft
          Windows Security Event Log' and search_payload ilike '%0x45A%' and "EventID"='808'
          or "EventID"='316' and search_payload ilike '%The print spooler failed to
          load a plug-in module%' Last 7 days
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -970,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "16":
    id: "16"
    taskid: 8239c2a7-a23f-4fdb-8b88-487cadf5fd3a
    type: playbook
    task:
      id: 8239c2a7-a23f-4fdb-8b88-487cadf5fd3a
      version: -1
      name: Search for suspicious SMB Event ID
      description: This playbook runs a QRadar query and return its results to the
        context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "24"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft
          Windows Security Event Log' and UTF8(payload) LIKE '%31017%' Last 7 days
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 0
    view: |-
      {
        "position": {
          "x": -970,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "17":
    id: "17"
    taskid: 5da59a60-4575-45b0-8e8d-b4fbaf20d860
    type: regular
    task:
      id: 5da59a60-4575-45b0-8e8d-b4fbaf20d860
      version: -1
      name: Search for event IDs 808, 316 and 31017
      description: Search for the windows event IDs 808, 316 and 31017 to find indication
        of the exploit.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 1050
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "18":
    id: "18"
    taskid: 3ffe1968-e80f-4b79-8b18-369bbd7078a2
    type: title
    task:
      id: 3ffe1968-e80f-4b79-8b18-369bbd7078a2
      version: -1
      name: CVE Mitigations
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "35"
      - "36"
      - "38"
      - "37"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 2300
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "20":
    id: "20"
    taskid: c0721a3f-91f6-4eba-8420-3f328f3c348f
    type: title
    task:
      id: c0721a3f-91f6-4eba-8420-3f328f3c348f
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 3620
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "23":
    id: "23"
    taskid: f5ba6e08-6201-4f0f-87e5-59c303e94345
    type: playbook
    task:
      id: f5ba6e08-6201-4f0f-87e5-59c303e94345
      version: -1
      name: Panorama Query Logs for PrintNightmare Threat IDs
      description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering
        and wildfire.'
      playbookName: Panorama Query Logs
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      log_type:
        simple: threat
      query:
        simple: (threatid eq 91333) or (threatid eq 91323)
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": 1820,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "24":
    id: "24"
    taskid: 077f00bb-f7db-40aa-8689-56609c8cfec6
    type: playbook
    task:
      id: 077f00bb-f7db-40aa-8689-56609c8cfec6
      version: -1
      name: Search for suspicious registry modification by Spoolsv
      description: This playbook runs a QRadar query and return its results to the
        context.
      playbookName: QRadarFullSearch
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "32"
    scriptarguments:
      interval:
        simple: "1"
      query_expression:
        simple: SELECT * from events where LOGSOURCETYPENAME(devicetype)='Microsoft
          Windows Security Event Log' and CATEGORYNAME(category) ILIKE 'Successful
          Registry Modification' and (UTF8(payload) ilike '%.dll%') and (UTF8(payload)
          ilike '%\spoolsv.exe') and (UTF8(payload) ilike '%\Data File%' or UTF8(payload)
          ilike '%\Configuration File%') Last 14 days
      timeout:
        simple: "600"
    separatecontext: true
    loop:
      iscommand: false
      scriptArguments:
        headers: {}
        interval:
          simple: "1"
        query_expression:
          simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft
            Windows Security Event Log' and UTF8(payload) LIKE '%31017%' Last 7 days
        range: {}
        timeout:
          simple: "600"
      exitCondition: ""
      wait: 1
      max: 100
    view: |-
      {
        "position": {
          "x": -970,
          "y": 1410
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "25":
    id: "25"
    taskid: d1c2af35-74e6-4a9a-870e-59de7ee16d4a
    type: regular
    task:
      id: d1c2af35-74e6-4a9a-870e-59de7ee16d4a
      version: -1
      name: Search for Spoolsv Suspicious Loaded Modules
      description: Identifies potentially suspicious module loads into Spoolsv.exe
        based on DLL loading from a specific path used by CVE-2021-34527.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      latest_time:
        complex:
          root: inputs.SplunkLatestTime
      query:
        simple: index="*" sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=7
          Image="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*"
          ImageLoaded="*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded)
          as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image
          Computer EventCode | where countImgloaded >= 3
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "26":
    id: "26"
    taskid: ac91f703-d4f8-4beb-8503-39b96331c078
    type: regular
    task:
      id: ac91f703-d4f8-4beb-8503-39b96331c078
      version: -1
      name: Search for Spoolsv Suspicious Process Access
      description: 'Identifies suspicious process access events from Spoolsv.exe with
        high granted process rights access to the target process. '
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "25"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      latest_time:
        complex:
          root: inputs.SplunkLatestTime
      query:
        simple: index="*" sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=10
          SourceImage = "*\\spoolsv.exe" CallTrace="*\\Windows\\system32\\spool\\DRIVERS\\x64\\*"
          TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff
          | stats  count min(_time) as firstTime max(_time) as lastTime by Computer
          SourceImage TargetImage GrantedAccess CallTrace  EventCode
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "27":
    id: "27"
    taskid: 7729de67-2ba0-44d9-88e3-fe032360518b
    type: regular
    task:
      id: 7729de67-2ba0-44d9-88e3-fe032360518b
      version: -1
      name: Search for suspicious Spoolsv Spawning Rundll32
      description: Detects Spoolsv with a child process of rundll32.exe.
      script: '|||splunk-search'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "26"
    scriptarguments:
      earliest_time:
        complex:
          root: inputs.SplunkEarliestTime
      latest_time:
        complex:
          root: inputs.SplunkLatestTime
      query:
        simple: |-
          index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventID=1  parent_process_name=spoolsv.exe process_name=rundll32.exe
            | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
            parent_process_name, process_name, OriginalFileName, process_path, CommandLine
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 190,
          "y": 1230
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  "29":
    id: "29"
    taskid: 23aac628-78ce-4897-8ae1-da26bdfdfaad
    type: condition
    task:
      id: 23aac628-78ce-4897-8ae1-da26bdfdfaad
      version: -1
      name: Analysis resolution - Should continue with the investigation?
      description: Check with the analyst whether to continue with the investigation.
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      "No":
      - "31"
      "Yes":
      - "30"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 3150
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    message:
      to:
      subject:
      body:
        simple: Do you need to continue with the investigation?
      methods: []
      format: ""
      bcc:
      cc:
      timings:
        retriescount: 2
        retriesinterval: 360
        completeafterreplies: 1
      replyOptions:
      - "Yes"
      - "No"
    skipunavailable: false
    quietmode: 0
  "30":
    id: "30"
    taskid: ac33c510-e7ac-44cf-8c34-9288b36172bb
    type: regular
    task:
      id: ac33c510-e7ac-44cf-8c34-9288b36172bb
      version: -1
      name: Investigate Further
      description: Manual step for further incident investigation.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "20"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 0,
          "y": 3420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "31":
    id: "31"
    taskid: 8e6caa72-0023-4339-8d21-12bda9f0cd26
    type: regular
    task:
      id: 8e6caa72-0023-4339-8d21-12bda9f0cd26
      version: -1
      name: Close Investigation
      description: Close the current incident
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "20"
    scriptarguments:
      closeReason:
        simple: No further actions are required.
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 3420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "32":
    id: "32"
    taskid: 7a5ed4a5-c5d4-47d0-822c-861fe3ccdfb3
    type: regular
    task:
      id: 7a5ed4a5-c5d4-47d0-822c-861fe3ccdfb3
      version: -1
      name: Search for suspicious Spoolsv Spawning Rundll32
      description: Detects Spoolsv with a child process of rundll32.exe.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "33"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 1610
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "33":
    id: "33"
    taskid: 3cbc6506-9d5e-46c3-8c79-3a605da669df
    type: regular
    task:
      id: 3cbc6506-9d5e-46c3-8c79-3a605da669df
      version: -1
      name: Search for Spoolsv Suspicious Process Access
      description: 'Identifies suspicious process access events from Spoolsv.exe with
        high granted process rights access to the target process. '
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "34"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 1800
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "34":
    id: "34"
    taskid: 57b3efdc-f9dc-4536-83ab-7d25a5507e9c
    type: regular
    task:
      id: 57b3efdc-f9dc-4536-83ab-7d25a5507e9c
      version: -1
      name: Search for Spoolsv Suspicious Loaded Modules
      description: Identifies potentially suspicious module loads into Spoolsv.exe
        based on DLL loading from a specific path used by CVE-2021-34527.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "18"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 1990
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "35":
    id: "35"
    taskid: 4cb51f09-c911-414a-86cf-274b6cfd4c57
    type: regular
    task:
      id: 4cb51f09-c911-414a-86cf-274b6cfd4c57
      version: -1
      name: Install Microsoft spooler service patches
      description: |2+
         the patch is currently not effective against the vulnerability, it is still recommended to patch windows systems.
        The security patch can be found below:
        [CVE-2021-1675](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675)
        [CVE-2021-34527](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34527)

      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -210,
          "y": 2500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "36":
    id: "36"
    taskid: 53b9d3d7-fe3b-40c5-8012-4cf67c070bf6
    type: regular
    task:
      id: 53b9d3d7-fe3b-40c5-8012-4cf67c070bf6
      version: -1
      name: Disable Print Spooler service
      description: |-
        Disable the Print Spooler service for unnecessary devices especially servers (like the Domain Controllers)
        [Example command to disable print spooler service](https://github.com/cube0x0/CVE-2021-1675) to disable the Print Spooler service:
        'Stop-Service Spooler
        REG ADD  "HKLM\SYSTEM\CurrentControlSet\Services\Spooler"  /v "Start " /t REG_DWORD /d "4" /f'
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 220,
          "y": 2500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "37":
    id: "37"
    taskid: 6bc4cfea-31b6-4ee9-8ef1-36aa49f1c9b6
    type: regular
    task:
      id: 6bc4cfea-31b6-4ee9-8ef1-36aa49f1c9b6
      version: -1
      name: Restricting the ACLs
      description: |-
        The exploit dropping a DLL in a subdirectory. If restricting the ACLs on the directory (and subdirectories), the exploit will be prevented.
        Relevant directory: 'C:\Windows\System32\spool\drivers'

        example of PowerShell script:
        $Path = "C:\Windows\System32\spool\drivers"

        $Acl = Get-Acl $Path

        $Ar = New-Object  System.Security.AccessControl.FileSystemAccessRule("System", "Modify", "ContainerInherit, ObjectInherit", "None", "Deny")

        $Acl.AddAccessRule($Ar)

        Set-Acl $Path $Acl

        [Source](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/)
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1090,
          "y": 2500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "38":
    id: "38"
    taskid: 818f6f49-e0cc-4ab0-8e04-a1fcce69470b
    type: regular
    task:
      id: 818f6f49-e0cc-4ab0-8e04-a1fcce69470b
      version: -1
      name: Disable Print Spooler Service Point and Print
      description: |-
        Check if the following conditions are true:
        Registry Settings: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
        NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting)
        UpdatePromptSettings = 0 (DWORD) or not defined (default setting)
        Group Policy: You have not configured the Point and Print Restrictions Group Policy.
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 680,
          "y": 2500
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "39":
    id: "39"
    taskid: e67a0dcf-a48f-4a5b-8be5-a3051a4e0faa
    type: title
    task:
      id: e67a0dcf-a48f-4a5b-8be5-a3051a4e0faa
      version: -1
      name: Resolution
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "29"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 460,
          "y": 3000
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "40":
    id: "40"
    taskid: 9a7c6f39-3f86-4b52-8b81-fbe81bada5d7
    type: title
    task:
      id: 9a7c6f39-3f86-4b52-8b81-fbe81bada5d7
      version: -1
      name: SIEM Hunting
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": -380,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "41":
    id: "41"
    taskid: 23e2edbf-c098-4ca8-8686-e603d63828f1
    type: title
    task:
      id: 23e2edbf-c098-4ca8-8686-e603d63828f1
      version: -1
      name: 'Vulnerabilities Hunting '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "7"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 920,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "42":
    id: "42"
    taskid: 68d709a8-a251-4f8d-84cd-489e06c37254
    type: title
    task:
      id: 68d709a8-a251-4f8d-84cd-489e06c37254
      version: -1
      name: 'Panorama Hunting '
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "23"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1820,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "43":
    id: "43"
    taskid: 0b02372d-250f-42e6-8979-e37100d64898
    type: title
    task:
      id: 0b02372d-250f-42e6-8979-e37100d64898
      version: -1
      name: Cortex XDR
      type: title
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "44"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 1370,
          "y": 550
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "44":
    id: "44"
    taskid: 2839bb90-887e-4478-8eeb-cf1f5c1f4b62
    type: playbook
    task:
      id: 2839bb90-887e-4478-8eeb-cf1f5c1f4b62
      version: -1
      name: Cortex XDR - PrintNightmare Detection and Response
      playbookName: Cortex XDR - PrintNightmare Detection and Response
      type: playbook
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "18"
    separatecontext: true
    view: |-
      {
        "position": {
          "x": 1370,
          "y": 730
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "29_31_No": 0.48
    },
    "paper": {
      "dimensions": {
        "height": 3605,
        "width": 3170,
        "x": -970,
        "y": 80
      }
    }
  }
inputs:
- key: CVE
  value:
    simple: CVE-2021-1675,CVE-2021-34527
  required: false
  description: PrintNightmare CVEs
  playbookInputQuery:
- key: SplunkEarliestTime
  value:
    simple: -30d
  required: false
  description: The earliest time for the Splunk search query.
  playbookInputQuery:
- key: SplunkLatestTime
  value:
    simple: now
  required: false
  description: The latest time for the Splunk search query.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 5.5.0