McAfee coverage on - CVE-2021-1675 (PrintNightmare 0-day exploit)

[Glenn_Bolton]

Thank you as always Daveb3d...Your comments are always well received.

Much appreciated.

[smurphy0822]

The spoolersv shouldn't have child processes running. Is there a way to write an expert rule, which blocks spoolersv from creating a child process?

[Daveb3d]

Oddly, it can...  but this rule would block that (and I put in a spot for FPs)

Rule {
	Process {
		Include OBJECT_NAME { -v "spoolsv.exe" }

	}
	Target {
		Match PROCESS {
			Include OBJECT_NAME { -v "**" }
			#Exclude OBJECT_NAME { -v "whatever.exe" }
			Include -access "CREATE"
		}
	}
}

This rule is more targeted but also covers more threats with it.

Rule {
	Process {
		Include OBJECT_NAME { -v "spoolsv.exe" }
	}
	Target {
	#block spawning of OS processes for injection purposes (e.g. CobaltStrike Spawn_to) or other uses (recon, cmd, powershell)
		Match PROCESS {
			Include OBJECT_NAME { -v "c:\\windows\\**" }
			Include -access "CREATE"
		}

		#block injection into running OS processes for process migration (e.g. Meterpreter migrate)
		Match PROCESS {
				Include OBJECT_NAME { -v "c:\\windows\\**" }
				Include -nt_access "!0x0020"
		}
		#block cred theft from lsass
		Match PROCESS {
			Include OBJECT_NAME { 
				-v "lsass.exe"
			}
			Include -nt_access "!0x0010"
		}
	}
}

[TravisNC]

Following, because this is about to be a trainwreck and hopefully McAfee has some rules available soon.

[Daveb3d]

See my post at https://community.mcafee.com/t5/Endpoint-Security-ENS/ENS-10-7-Servers-CVE-2021-1675-Print-Spooler-0...

Rule {
	Process {
		Include OBJECT_NAME { -v "spoolsv.exe" }
	}
	Target {
		Match FILE {
			Include OBJECT_NAME { -v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\kernelbase.dll" }
			Include -access "CREATE"
		}
	}
}

[Pravas]

Hi All,

The vulnerability is still under investigation. Meanwhile McAfee recommends to disable Print Spooler Service on all Servers.

https://kc.mcafee.com/corporate/index?page=content&id=KB94659

Thanks

[Daveb3d]

SharpPrintNightmare defeats my rule above..  updated to include coverage there:

Rule {
	Process {
		Include OBJECT_NAME { -v "spoolsv.exe" }
	}
	Target {
		Match FILE {
			Include OBJECT_NAME { 
            -v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\kernelbase.dll"
            -v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\winhttp.dll"
            }
			Include -access "CREATE"
		}
	}
}

[Korny]

You solution doesn't work for me, so I changed it to this:
Rule {

Process {
Include OBJECT_NAME { -v "spoolsv.exe" }
}
Target {
Match FILE {
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\kernelbase.dll" }
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\winhttp.dll" }


Include -access "CREATE"
}
}
}

[ChrisQ]

I don't have much experience with custom rules. 

Can anyone confirm the following two rules are pretty much the same and the Match FILE section can be written in either way? 

Rule {
Process {
Include OBJECT_NAME { -v "spoolsv.exe" }
}
Target {
Match FILE {
Include OBJECT_NAME {
-v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\kernelbase.dll"
-v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\winhttp.dll"
-v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\ntdll.dll"
-v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\kernel32.dll"
-v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\user32.dll"
}
Include -access "CREATE"
}
}
}

Rule {

Process {
Include OBJECT_NAME { -v "spoolsv.exe" }
}
Target {
Match FILE {
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\kernelbase.dll" }
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\winhttp.dll" }
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\ntdll.dll" }
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\kernel32.dll" }
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\x64\\3\\user32.dll" }

Include -access "CREATE"
}
}
}

[Daveb3d]

Yup..  both will work.  I do basically all my rules the first way.