Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
The Windows Print Spooler service with the PrintNightmare vulnerability runs on Windows domain controllers by default. Exploit code for the PrintNightmare vulnerability is publicly available. An authenticated attacker with network access to a vulnerable device can run arbitrary code with SYSTEM privileges, gaining complete control of a device.
Kill Chain
Risk Score
83
The Microsoft Windows Print Spooler service contains a vulnerability that fails to restrict access to RpcAddPrinterDriverEx() and RpcAsyncAddPrinterDriver, which are operations for remotely installing a printer driver on a system. An attacker makes a remote procedure call (RPC) to RpcAddPrinterDriverEx() or RpcAsyncAddPrinterDriver() operations to specify a printer driver file (such as a DLL file) to install on a server. The DLL file contains malicious code. In modern Microsoft environments, the operations and malicious DLL file name can be concealed from network defenders within an encrypted SMBv3 or RPC connection. After the Print Spooler service, spoolsv.exe, runs the malicious, arbitrary code in the DLL file with SYSTEM privileges, the attacker can install programs, change data, or create new accounts with full user rights.
