id: CVE-2021-1675 - PrintNightmare version: -1 contentitemexportablefields: contentitemfields: {} name: CVE-2021-34527 | CVE-2021-1675 - PrintNightmare description: |- **The playbook can be triggered manually or automatically by setting up a reoccurring job.** Microsoft has released a security update in June 2021 Patch Tuesday for CVE-2021-1675, a Local Privilege Escalation vulnerability in the Print Spooler Service. Later that month, researchers found another method to exploit the Print Spooler service remotely, which raised the severity of the vulnerability due to the fact that the new method allows Remote Code Execution, a new ID was given to the critical vulnerability - CVE-2021-34527. Microsoft patched the vulnerability in June but an exploit POC and complete technical analysis were made publicly available online. **Update 7.8.2021 - Microsoft has released an emergency patch for the PrintNightmare. A reference for the patch can be found in "Install Microsoft spooler service patches" task. This playbook includes the following tasks: - Manual actions to mitigate the exploit - Search Vulnerable Devices using the CVE - Query SIEM, FW, XDR to detect malicious activity and compromised hosts - Run Dedicated Detection and Response playbook for Cortex XDR More details on the vulnerabilities: [CVE-2021-1675 LPE](https://nvd.nist.gov/vuln/detail/CVE-2021-1675) [CVE-2021-34527 RCE](https://nvd.nist.gov/vuln/detail/CVE-2021-34527) ** Note: This is a beta playbook, which lets you implement and test pre-release software. Since the playbook is beta, it might contain bugs. Updates to the pack during the beta phase might include non-backward compatible features. We appreciate your feedback on the quality and usability of the pack to help us identify issues, fix them, and continually improve. starttaskid: "0" tasks: "0": id: "0" taskid: f1cfc2ee-24a8-469d-842d-be83b7dc2ca1 type: start task: id: f1cfc2ee-24a8-469d-842d-be83b7dc2ca1 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "40" - "41" - "43" - "42" separatecontext: false view: |- { "position": { "x": 430, "y": 80 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "2": id: "2" taskid: a26d7d7c-a25e-414b-83c8-8c00b2087390 type: regular task: id: a26d7d7c-a25e-414b-83c8-8c00b2087390 version: -1 name: Run vulnerability scan description: |+ Run a vulnerability scan to find vulnerable devices. Either by running PowerShell script or initiate a new scan with vulnerability scanner tool. type: regular iscommand: false brand: "" nexttasks: '#none#': - "39" separatecontext: false view: |- { "position": { "x": 460, "y": 2830 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "6": id: "6" taskid: 0c90e265-d762-414e-8a33-d7eed8a9bd1d type: title task: id: 0c90e265-d762-414e-8a33-d7eed8a9bd1d version: -1 name: Vulnerability Scan type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "2" separatecontext: false view: |- { "position": { "x": 460, "y": 2680 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "7": id: "7" taskid: 2a67bf0f-29f4-45ac-8634-8179c695e438 type: playbook task: id: 2a67bf0f-29f4-45ac-8634-8179c695e438 version: -1 name: Search Endpoint by CVE - Generic playbookName: Search Endpoint by CVE - Generic type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "18" scriptarguments: CVE_ID: complex: root: inputs.CVE separatecontext: false loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 920, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "9": id: "9" taskid: 21a9d6cc-f618-4656-85d9-a85ba15a4b76 type: title task: id: 21a9d6cc-f618-4656-85d9-a85ba15a4b76 version: -1 name: Splunk type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "13" separatecontext: false view: |- { "position": { "x": 190, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "10": id: "10" taskid: b0655aa0-9ac3-42eb-84e0-8ce440b9a142 type: title task: id: b0655aa0-9ac3-42eb-84e0-8ce440b9a142 version: -1 name: Qradar type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "15" separatecontext: false view: |- { "position": { "x": -970, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "11": id: "11" taskid: afeb0f51-42c5-4907-87bf-a8973e4ea518 type: title task: id: afeb0f51-42c5-4907-87bf-a8973e4ea518 version: -1 name: 'Manually Hunt Windows Event Logs ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "17" separatecontext: false view: |- { "position": { "x": -380, "y": 910 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "12": id: "12" taskid: 7fa0b9d9-8a02-4d94-8e57-88369afe81e8 type: condition task: id: 7fa0b9d9-8a02-4d94-8e57-88369afe81e8 version: -1 name: Is SIEM enabled? description: Returns 'yes' if integration brand is available. Otherwise returns 'no' type: condition iscommand: false brand: "" nexttasks: '#default#': - "11" Qradar: - "10" Splunk: - "9" separatecontext: false conditions: - label: Splunk condition: - - operator: isEqualString left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: SplunkPy ignorecase: true accessor: state iscontext: true right: value: simple: active ignorecase: true - label: Qradar condition: - - operator: isEqualString left: value: complex: root: modules filters: - - operator: isEqualString left: value: simple: modules.brand iscontext: true right: value: simple: QRadar_v2 ignorecase: true accessor: state iscontext: true right: value: simple: active ignorecase: true view: |- { "position": { "x": -380, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "13": id: "13" taskid: 6051b84a-2d2e-4726-860d-f65d1eb261d5 type: regular task: id: 6051b84a-2d2e-4726-860d-f65d1eb261d5 version: -1 name: Search for suspicious Print Spooler and SMB Event IDs description: "Searches Splunk for Event IDs related to PrintNightmare vulnerability:\n\ 808 (Print Spooler) \n316 (Print Spooler) \n31017 (SMB)" script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "27" scriptarguments: earliest_time: complex: root: inputs.SplunkEarliestTime latest_time: complex: root: inputs.SplunkLatestTime query: simple: index="*" sourcetype="WinEventLog" source="WinEventLog:Security" EventCode= 808 OR EventCode=316 OR EventCode=31017 separatecontext: false view: |- { "position": { "x": 190, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "15": id: "15" taskid: ef8e40cb-46a1-42dd-84df-bd7cc8edbd03 type: playbook task: id: ef8e40cb-46a1-42dd-84df-bd7cc8edbd03 version: -1 name: Search for suspicious Print Spooler Event IDs description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" nexttasks: '#none#': - "16" scriptarguments: interval: simple: "1" query_expression: simple: SELECT UTF8(payload) as search_payload from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and search_payload ilike '%0x45A%' and "EventID"='808' or "EventID"='316' and search_payload ilike '%The print spooler failed to load a plug-in module%' Last 7 days timeout: simple: "600" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -970, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "16": id: "16" taskid: 8239c2a7-a23f-4fdb-8b88-487cadf5fd3a type: playbook task: id: 8239c2a7-a23f-4fdb-8b88-487cadf5fd3a version: -1 name: Search for suspicious SMB Event ID description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: interval: simple: "1" query_expression: simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft Windows Security Event Log' and UTF8(payload) LIKE '%31017%' Last 7 days timeout: simple: "600" separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": -970, "y": 1230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "17": id: "17" taskid: 5da59a60-4575-45b0-8e8d-b4fbaf20d860 type: regular task: id: 5da59a60-4575-45b0-8e8d-b4fbaf20d860 version: -1 name: Search for event IDs 808, 316 and 31017 description: Search for the windows event IDs 808, 316 and 31017 to find indication of the exploit. type: regular iscommand: false brand: "" nexttasks: '#none#': - "32" separatecontext: false view: |- { "position": { "x": -380, "y": 1050 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "18": id: "18" taskid: 3ffe1968-e80f-4b79-8b18-369bbd7078a2 type: title task: id: 3ffe1968-e80f-4b79-8b18-369bbd7078a2 version: -1 name: CVE Mitigations type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "35" - "36" - "38" - "37" separatecontext: false view: |- { "position": { "x": 450, "y": 2300 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "20": id: "20" taskid: c0721a3f-91f6-4eba-8420-3f328f3c348f type: title task: id: c0721a3f-91f6-4eba-8420-3f328f3c348f version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 460, "y": 3620 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "23": id: "23" taskid: f5ba6e08-6201-4f0f-87e5-59c303e94345 type: playbook task: id: f5ba6e08-6201-4f0f-87e5-59c303e94345 version: -1 name: Panorama Query Logs for PrintNightmare Threat IDs description: 'Query Panorama Logs of types: traffic, threat, url, data-filtering and wildfire.' playbookName: Panorama Query Logs type: playbook iscommand: false brand: "" nexttasks: '#none#': - "18" scriptarguments: log_type: simple: threat query: simple: (threatid eq 91333) or (threatid eq 91323) separatecontext: true loop: iscommand: false exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": 1820, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "24": id: "24" taskid: 077f00bb-f7db-40aa-8689-56609c8cfec6 type: playbook task: id: 077f00bb-f7db-40aa-8689-56609c8cfec6 version: -1 name: Search for suspicious registry modification by Spoolsv description: This playbook runs a QRadar query and return its results to the context. playbookName: QRadarFullSearch type: playbook iscommand: false brand: "" nexttasks: '#none#': - "32" scriptarguments: interval: simple: "1" query_expression: simple: SELECT * from events where LOGSOURCETYPENAME(devicetype)='Microsoft Windows Security Event Log' and CATEGORYNAME(category) ILIKE 'Successful Registry Modification' and (UTF8(payload) ilike '%.dll%') and (UTF8(payload) ilike '%\spoolsv.exe') and (UTF8(payload) ilike '%\Data File%' or UTF8(payload) ilike '%\Configuration File%') Last 14 days timeout: simple: "600" separatecontext: true loop: iscommand: false scriptArguments: headers: {} interval: simple: "1" query_expression: simple: select * from events WHERE LogSourceTypeName(deviceType) = 'Microsoft Windows Security Event Log' and UTF8(payload) LIKE '%31017%' Last 7 days range: {} timeout: simple: "600" exitCondition: "" wait: 1 max: 100 view: |- { "position": { "x": -970, "y": 1410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "25": id: "25" taskid: d1c2af35-74e6-4a9a-870e-59de7ee16d4a type: regular task: id: d1c2af35-74e6-4a9a-870e-59de7ee16d4a version: -1 name: Search for Spoolsv Suspicious Loaded Modules description: Identifies potentially suspicious module loads into Spoolsv.exe based on DLL loading from a specific path used by CVE-2021-34527. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "18" scriptarguments: earliest_time: complex: root: inputs.SplunkEarliestTime latest_time: complex: root: inputs.SplunkLatestTime query: simple: index="*" sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=7 Image="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*" ImageLoaded="*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded) as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer EventCode | where countImgloaded >= 3 separatecontext: false view: |- { "position": { "x": 190, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "26": id: "26" taskid: ac91f703-d4f8-4beb-8503-39b96331c078 type: regular task: id: ac91f703-d4f8-4beb-8503-39b96331c078 version: -1 name: Search for Spoolsv Suspicious Process Access description: 'Identifies suspicious process access events from Spoolsv.exe with high granted process rights access to the target process. ' script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "25" scriptarguments: earliest_time: complex: root: inputs.SplunkEarliestTime latest_time: complex: root: inputs.SplunkLatestTime query: simple: index="*" sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace="*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | stats count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage TargetImage GrantedAccess CallTrace EventCode separatecontext: false view: |- { "position": { "x": 190, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "27": id: "27" taskid: 7729de67-2ba0-44d9-88e3-fe032360518b type: regular task: id: 7729de67-2ba0-44d9-88e3-fe032360518b version: -1 name: Search for suspicious Spoolsv Spawning Rundll32 description: Detects Spoolsv with a child process of rundll32.exe. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "26" scriptarguments: earliest_time: complex: root: inputs.SplunkEarliestTime latest_time: complex: root: inputs.SplunkLatestTime query: simple: |- index=* sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventID=1 parent_process_name=spoolsv.exe process_name=rundll32.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine separatecontext: false view: |- { "position": { "x": 190, "y": 1230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 "29": id: "29" taskid: 23aac628-78ce-4897-8ae1-da26bdfdfaad type: condition task: id: 23aac628-78ce-4897-8ae1-da26bdfdfaad version: -1 name: Analysis resolution - Should continue with the investigation? description: Check with the analyst whether to continue with the investigation. type: condition iscommand: false brand: "" nexttasks: "No": - "31" "Yes": - "30" separatecontext: false view: |- { "position": { "x": 460, "y": 3150 } } note: false timertriggers: [] ignoreworker: false message: to: subject: body: simple: Do you need to continue with the investigation? methods: [] format: "" bcc: cc: timings: retriescount: 2 retriesinterval: 360 completeafterreplies: 1 replyOptions: - "Yes" - "No" skipunavailable: false quietmode: 0 "30": id: "30" taskid: ac33c510-e7ac-44cf-8c34-9288b36172bb type: regular task: id: ac33c510-e7ac-44cf-8c34-9288b36172bb version: -1 name: Investigate Further description: Manual step for further incident investigation. type: regular iscommand: false brand: "" nexttasks: '#none#': - "20" separatecontext: false view: |- { "position": { "x": 0, "y": 3420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "31": id: "31" taskid: 8e6caa72-0023-4339-8d21-12bda9f0cd26 type: regular task: id: 8e6caa72-0023-4339-8d21-12bda9f0cd26 version: -1 name: Close Investigation description: Close the current incident script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "20" scriptarguments: closeReason: simple: No further actions are required. separatecontext: false view: |- { "position": { "x": 460, "y": 3420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "32": id: "32" taskid: 7a5ed4a5-c5d4-47d0-822c-861fe3ccdfb3 type: regular task: id: 7a5ed4a5-c5d4-47d0-822c-861fe3ccdfb3 version: -1 name: Search for suspicious Spoolsv Spawning Rundll32 description: Detects Spoolsv with a child process of rundll32.exe. type: regular iscommand: false brand: "" nexttasks: '#none#': - "33" separatecontext: false view: |- { "position": { "x": -380, "y": 1610 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "33": id: "33" taskid: 3cbc6506-9d5e-46c3-8c79-3a605da669df type: regular task: id: 3cbc6506-9d5e-46c3-8c79-3a605da669df version: -1 name: Search for Spoolsv Suspicious Process Access description: 'Identifies suspicious process access events from Spoolsv.exe with high granted process rights access to the target process. ' type: regular iscommand: false brand: "" nexttasks: '#none#': - "34" separatecontext: false view: |- { "position": { "x": -380, "y": 1800 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "34": id: "34" taskid: 57b3efdc-f9dc-4536-83ab-7d25a5507e9c type: regular task: id: 57b3efdc-f9dc-4536-83ab-7d25a5507e9c version: -1 name: Search for Spoolsv Suspicious Loaded Modules description: Identifies potentially suspicious module loads into Spoolsv.exe based on DLL loading from a specific path used by CVE-2021-34527. type: regular iscommand: false brand: "" nexttasks: '#none#': - "18" separatecontext: false view: |- { "position": { "x": -380, "y": 1990 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "35": id: "35" taskid: 4cb51f09-c911-414a-86cf-274b6cfd4c57 type: regular task: id: 4cb51f09-c911-414a-86cf-274b6cfd4c57 version: -1 name: Install Microsoft spooler service patches description: |2+ the patch is currently not effective against the vulnerability, it is still recommended to patch windows systems. The security patch can be found below: [CVE-2021-1675](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675) [CVE-2021-34527](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34527) type: regular iscommand: false brand: "" nexttasks: '#none#': - "6" separatecontext: false view: |- { "position": { "x": -210, "y": 2500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "36": id: "36" taskid: 53b9d3d7-fe3b-40c5-8012-4cf67c070bf6 type: regular task: id: 53b9d3d7-fe3b-40c5-8012-4cf67c070bf6 version: -1 name: Disable Print Spooler service description: |- Disable the Print Spooler service for unnecessary devices especially servers (like the Domain Controllers) [Example command to disable print spooler service](https://github.com/cube0x0/CVE-2021-1675) to disable the Print Spooler service: 'Stop-Service Spooler REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Spooler" /v "Start " /t REG_DWORD /d "4" /f' type: regular iscommand: false brand: "" nexttasks: '#none#': - "6" separatecontext: false view: |- { "position": { "x": 220, "y": 2500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "37": id: "37" taskid: 6bc4cfea-31b6-4ee9-8ef1-36aa49f1c9b6 type: regular task: id: 6bc4cfea-31b6-4ee9-8ef1-36aa49f1c9b6 version: -1 name: Restricting the ACLs description: |- The exploit dropping a DLL in a subdirectory. If restricting the ACLs on the directory (and subdirectories), the exploit will be prevented. Relevant directory: 'C:\Windows\System32\spool\drivers' example of PowerShell script: $Path = "C:\Windows\System32\spool\drivers" $Acl = Get-Acl $Path $Ar = New-Object System.Security.AccessControl.FileSystemAccessRule("System", "Modify", "ContainerInherit, ObjectInherit", "None", "Deny") $Acl.AddAccessRule($Ar) Set-Acl $Path $Acl [Source](https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/) type: regular iscommand: false brand: "" nexttasks: '#none#': - "6" separatecontext: false view: |- { "position": { "x": 1090, "y": 2500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "38": id: "38" taskid: 818f6f49-e0cc-4ab0-8e04-a1fcce69470b type: regular task: id: 818f6f49-e0cc-4ab0-8e04-a1fcce69470b version: -1 name: Disable Print Spooler Service Point and Print description: |- Check if the following conditions are true: Registry Settings: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting) UpdatePromptSettings = 0 (DWORD) or not defined (default setting) Group Policy: You have not configured the Point and Print Restrictions Group Policy. type: regular iscommand: false brand: "" nexttasks: '#none#': - "6" separatecontext: false view: |- { "position": { "x": 680, "y": 2500 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "39": id: "39" taskid: e67a0dcf-a48f-4a5b-8be5-a3051a4e0faa type: title task: id: e67a0dcf-a48f-4a5b-8be5-a3051a4e0faa version: -1 name: Resolution type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "29" separatecontext: false view: |- { "position": { "x": 460, "y": 3000 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "40": id: "40" taskid: 9a7c6f39-3f86-4b52-8b81-fbe81bada5d7 type: title task: id: 9a7c6f39-3f86-4b52-8b81-fbe81bada5d7 version: -1 name: SIEM Hunting type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "12" separatecontext: false view: |- { "position": { "x": -380, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "41": id: "41" taskid: 23e2edbf-c098-4ca8-8686-e603d63828f1 type: title task: id: 23e2edbf-c098-4ca8-8686-e603d63828f1 version: -1 name: 'Vulnerabilities Hunting ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "7" separatecontext: false view: |- { "position": { "x": 920, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "42": id: "42" taskid: 68d709a8-a251-4f8d-84cd-489e06c37254 type: title task: id: 68d709a8-a251-4f8d-84cd-489e06c37254 version: -1 name: 'Panorama Hunting ' type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "23" separatecontext: false view: |- { "position": { "x": 1820, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "43": id: "43" taskid: 0b02372d-250f-42e6-8979-e37100d64898 type: title task: id: 0b02372d-250f-42e6-8979-e37100d64898 version: -1 name: Cortex XDR type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "44" separatecontext: false view: |- { "position": { "x": 1370, "y": 550 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 "44": id: "44" taskid: 2839bb90-887e-4478-8eeb-cf1f5c1f4b62 type: playbook task: id: 2839bb90-887e-4478-8eeb-cf1f5c1f4b62 version: -1 name: Cortex XDR - PrintNightmare Detection and Response playbookName: Cortex XDR - PrintNightmare Detection and Response type: playbook iscommand: false brand: "" description: '' nexttasks: '#none#': - "18" separatecontext: true view: |- { "position": { "x": 1370, "y": 730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 view: |- { "linkLabelsPosition": { "29_31_No": 0.48 }, "paper": { "dimensions": { "height": 3605, "width": 3170, "x": -970, "y": 80 } } } inputs: - key: CVE value: simple: CVE-2021-1675,CVE-2021-34527 required: false description: PrintNightmare CVEs playbookInputQuery: - key: SplunkEarliestTime value: simple: -30d required: false description: The earliest time for the Splunk search query. playbookInputQuery: - key: SplunkLatestTime value: simple: now required: false description: The latest time for the Splunk search query. playbookInputQuery: outputs: [] tests: - No tests (auto formatted) fromversion: 5.5.0