ID | Technique | Tactic |
---|---|---|
T1547.012 | Print Processors | Persistence |
T1547 | Boot or Logon Autostart Execution | Privilege Escalation |
Detection: Print Spooler Failed to Load a Plug-in
Description
The following analytic detects driver load errors in the Windows PrintService Admin logs, specifically identifying issues related to CVE-2021-34527 (PrintNightmare). It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A. This detection method leverages specific event codes and error messages. This activity is significant as it may indicate an exploitation attempt of a known vulnerability. If confirmed malicious, an attacker could gain unauthorized code execution on the affected system, leading to potential system compromise.
Search
1`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\"))
2| stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message
3| `security_content_ctime(firstTime)`
4| `security_content_ctime(lastTime)`
5| `print_spooler_failed_to_load_a_plug_in_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
Windows Event Log Printservice 808 | Windows | 'WinEventLog' |
'WinEventLog:Microsoft-Windows-PrintService/Admin' |
N/A |
Macros Used
Name | Value |
---|---|
printservice | source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin" |
print_spooler_failed_to_load_a_plug_in_filter | search * |
print_spooler_failed_to_load_a_plug_in_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Notable | Yes |
Rule Title | %name% |
Rule Description | %description% |
Notable Event Fields | user, dest |
Creates Risk Event | True |
Implementation
You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems.
Known False Positives
False positives are unknown and filtering may be required.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. | 72 | 80 | 90 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | WinEventLog:Microsoft-Windows-PrintService/Admin |
WinEventLog |
Integration | ✅ Passing | Dataset | WinEventLog:Microsoft-Windows-PrintService/Admin |
WinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2