Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
First query digs in print spooler drivers folder for any file creations, MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files or ones that don't have any relations to printers that you are using are suspicious. Second query that can be used for finding client machines that could be operating print servers or file servers is also included here. As additional mitigation for the exploit you might want to block the incoming traffic to the SMB or EPMAP Ports (445) if you need to ke
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | GitHub Only |
| ID | ec1e131a-79cb-4f5c-b5e6-3edc5574ac68 |
| Tactics | Privilege escalation, Lateral movement, Exploit |
| Required Connectors | MicrosoftThreatProtection |
| Source | [View on GitHub](https://github.com/Azure/Azure-Sentinel/blob/master/Hunting Queries/Microsoft%20365%20Defender/Exploits/printnightmare-cve-2021-1675%20usage%20detection%20%281%29.yaml) |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊