Detecting PrintNightmare and Print Spooler Abuse

PrintNightmare (CVE-2021-34527) abused the spooler’s driver installation RPC calls so an authenticated user could make the SYSTEM-level spooler load an attacker-controlled DLL, giving local privilege escalation and, on exposed hosts, remote code execution (T1068). Microsoft shipped fixes and later changed Point and Print defaults, but unpatched hosts, weakened registry settings and spooler enabled on domain controllers still appear in real environments.

Signals at a Glance

Process and File Artifacts

Exploit success is visible in two places on the host. The spooler is a long-lived service that should rarely start children, and it should only write signed driver files into its driver store. Either breach of those norms is high confidence:

title: Print Spooler Spawning Suspicious Child Process
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\spoolsv.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
  filter_driver_helper:
    CommandLine|contains: 'PrintUI.dll'
  condition: selection and not filter_driver_helper
level: high
# tune/validate: some print drivers launch helper processes; confirm against your driver set.

// Microsoft Defender (KQL) - DLLs written into the spool driver store
DeviceFileEvents
| where InitiatingProcessFileName =~ "spoolsv.exe"
| where FolderPath has "spool" and FolderPath has "drivers"
| where FileName endswith ".dll"
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessAccountName
// Follow up: image-load events where spoolsv.exe loaded that SHA256.

Configuration and Exposure

The strongest control is not running the spooler where it is not needed, and verifying that Point and Print has not been weakened. Check both on a schedule and alert on drift:

# Is the spooler running on servers and domain controllers that should not print?
Get-Service Spooler | Select-Object Name, Status, StartType

# Point and Print settings that weaken the mitigation
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -ErrorAction SilentlyContinue |
  Select-Object NoWarningNoElevationOnInstall, UpdatePromptSettings, RestrictDriverInstallationToAdministrators
# tune/validate: NoWarningNoElevationOnInstall = 1 or UpdatePromptSettings = 0 is a finding.

• Disable the spooler on domain controllers and other servers that do not print. This also removes coercion techniques that abuse the spooler to force authentication.
• Keep RestrictDriverInstallationToAdministrators enforced, so ordinary users cannot install drivers through RPC.
• Check patch level against the July 2021 fixes and later Windows updates; treat a missing patch on any host with the spooler running as a finding in its own right.