Windows Print Spooler Exploit Attempt - CVE-2021-34527

The Microsoft Windows Print Spooler service contains a vulnerability that fails to restrict access to RpcAddPrinterDriverEx() and RpcAsyncAddPrinterDriver, which are operations for remotely installing a printer driver on a system. An attacker makes a remote procedure call (RPC) to RpcAddPrinterDriverEx() or RpcAsyncAddPrinterDriver() operations to specify a printer driver file (such as a DLL file) to install on a server. The DLL file contains malicious code. In modern Microsoft environments, the operations and malicious DLL file name can be concealed from network defenders within an encrypted SMBv3 or RPC connection. After the Print Spooler service, spoolsv.exe, runs the malicious, arbitrary code in the DLL file with SYSTEM privileges, the attacker can install programs, change data, or create new accounts with full user rights.