ET POLICY [MS-RPRN] Windows Printer Spooler Activity - AddPrinterDriverEx with Suspicious Filepath
Sourceet/open
CreatedJuly 6, 2021
UpdatedJuly 8, 2021
Classificationmisc-activity
alert tcp any any -> $HOME_NET [139,445] (msg:"ET POLICY [MS-RPRN] Windows Printer Spooler Activity - AddPrinterDriverEx with Suspicious Filepath"; flow:established,to_server; content:"|00|"; startswith; content:"SMB"; distance:4; within:3; content:"|00 00|"; distance:0; content:"|10 00 00 00|"; distance:1; within:4; content:"|59 00|"; distance:14; within:2; content:"|5c|spool|5c|drivers|5c|x64|5c|3|5c|old|5c|"; fast_pattern; classtype:misc-activity; sid:2033246; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2021_07_06, cve 2021_34527, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_07_08;)
Metadata
affected productWindows_XP_Vista_7_8_10_Server_32_64_Bit
created at2021_07_06
cve2021_34527
confidenceHigh
signature severityInformational
tagDescription_Generated_By_Proofpoint_Nexus
updated at2021_07_08
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!