New Printer Driver Installation Request

An attacker can create a malicious, unsigned printer driver DLL file and inject malicious, arbitrary code into the Windows Print Spooler service to perform remote code execution (RCE). An attacker makes remote procedure calls (RPCs) to RpcAddPrinterDriverEx(), RpcAsyncAddPrinterDriver, or RpcAddPrinterDriver, which are operations for remotely installing a printer driver file (such as a DLL file) on a system. The DLL file contains malicious code. In modern Microsoft environments, the operations and malicious DLL file name can be concealed from network defenders within an encrypted SMBv3 or RPC connection. After the Print Spooler service runs the malicious code with full SYSTEM privileges, the attacker is able to install malware, change data, or create new accounts with full user rights. PrintNightmare is an RCE vulnerability in the Print Spooler service that fails to restrict access to operations required to install a printer driver on a system remotely. Unless the server is vulnerable to PrintNightmare, the attacker must have correct privileges and policies on the server to remotely install a malicious unsigned printer driver.