Rule History

SID: 2033246 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 3 • Jul 6, 2021, 12:00 PM

Message:

ET POLICY [MS-RPRN] Windows Printer Spooler Activity - AddPrinterDriverEx with Suspicious Filepath

Rule:

alert tcp any any -> $HOME_NET [139,445] (msg:"ET POLICY [MS-RPRN] Windows Printer Spooler Activity - AddPrinterDriverEx with Suspicious Filepath"; flow:established,to_server; content:"|00|"; startswith; content:"SMB"; distance:4; within:3; content:"|00 00|"; distance:0; content:"|10 00 00 00|"; distance:1; within:4; content:"|59 00|"; distance:14; within:2; content:"|5c|spool|5c|drivers|5c|x64|5c|3|5c|old|5c|"; fast_pattern; classtype:misc-activity; sid:2033246; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2021_07_06, cve 2021_34527, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_08;)

Created:

Jul 6, 2021, 12:00 PM

Updated:

Jul 8, 2021, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Sep 10, 2025, 9:34 PM

Filename:

rules/emerging-policy.rules