CVE-2021-36958

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "spoolsv.exe"
| where FileName !in ("rundll32.exe", "printfilterpipelinesvc.exe", "printisolationhost.exe") // Bekannte, legitime Kindprozesse ausschließen
| where ProcessCommandLine has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "cscript.exe", "wscript.exe", "regsvr32.exe")
  or FolderPath has_any ("\Windows\Temp\", "\ProgramData\", "\Users\Public\") // Ungewöhnliche Ausführungsorte
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessParentFileName, InitiatingProcessParentCommandLine
// Zusätzliche Überwachung für SMB-Verbindungen zu externen/unbekannten Zielen
| join kind=leftouter (
    DeviceNetworkEvents
    | where InitiatingProcessFileName =~ "spoolsv.exe"
    | where RemotePort == 445 // SMB-Port
    | where RemoteIP !in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16") // Private IP-Bereiche ausschließen
    | summarize make_set(RemoteIP) by DeviceName, InitiatingProcessFileName
    | project DeviceName, SpoolerSMBConnections = set_RemoteIP
) on DeviceName
| extend SpoolerSMBConnections = iif(isnotempty(SpoolerSMBConnections), SpoolerSMBConnections, dynamic([]))

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4688 Image="*\\spoolsv.exe" NewProcessName IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\mshta.exe", "*\\cscript.exe", "*\\wscript.exe", "*\\regsvr32.exe") NOT (NewProcessName IN ("*\\rundll32.exe", "*\\printfilterpipelinesvc.exe", "*\\printisolationhost.exe"))
| table _time, Host, Image, NewProcessName, CommandLine, ParentProcessName, ParentCommandLine

| append [
  index=windows sourcetype=WinEventLog:Microsoft-Windows-SMBClient/Operational EventCode=30804 InitiatingProcessName="*\\spoolsv.exe" DestinationPort=445 DestinationIpAddress!="10.*" DestinationIpAddress!="172.16.*" DestinationIpAddress!="192.168.*"
  | stats count by _time, Host, InitiatingProcessName, DestinationIpAddress, DestinationPort
]

Sigma

title: Windows Print Spooler LPE via Arbitrary File Operations
id: 00000000-0000-0000-0000-000000000001
status: experimental
description: Detects suspicious process creation by the Print Spooler service, indicative of CVE-2021-36958 exploitation.
author: SecBoard Operations
date: 2023/10/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\spoolsv.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\regsvr32.exe'
  filter_known_legit:
    Image|endswith:
      - '\rundll32.exe'
      - '\printfilterpipelinesvc.exe'
      - '\printisolationhost.exe'
  condition: selection and not filter_known_legit
fields:
  - Image
  - CommandLine
  - ParentImage
  - ParentCommandLine
level: high

---

title: Windows Print Spooler Outbound SMB to Non-Internal IPs
id: 00000000-0000-0000-0000-000000000002
status: experimental
description: Detects outbound SMB connections initiated by the Print Spooler service to non-internal IP addresses, which could indicate an attempt to connect to a malicious shared printer.
author: SecBoard Operations
date: 2023/10/27
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\spoolsv.exe'
    DestinationPort: 445
    DestinationIpAddress|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
    DestinationIpAddress|startswith|negate:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
  condition: selection
fields:
  - Image
  - DestinationIpAddress
  - DestinationPort
level: medium

Elastic ES|QL

FROM process WHERE event.action == "process_started" AND process.parent.executable == "spoolsv.exe" AND process.executable IN ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "cscript.exe", "wscript.exe", "regsvr32.exe") AND NOT process.executable IN ("rundll32.exe", "printfilterpipelinesvc.exe", "printisolationhost.exe")
| SELECT @timestamp, host.name, process.parent.executable, process.executable, process.command_line, process.parent.command_line

---

FROM network WHERE event.action == "network_connection" AND process.executable == "spoolsv.exe" AND destination.port == 445 AND NOT destination.ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| SELECT @timestamp, host.name, process.executable, destination.ip, destination.port