McAfee coverage on - CVE-2021-1675 (PrintNightmare 0-day exploit)

[Daveb3d]

You need to do a \\ rather than a single \ on the paths... so...

Exclude OBJECT_NAME { -v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\New\\FXS*.DLL" }

btw, you can group your includes and excludes like this to make it easier:

Exclude OBJECT_NAME {

-v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\New\\FXS*.DLL"

-v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Old\\1\\FXS.DLL"

}

[youngs]

@Daveb3d thanks for you quick response.  

So, the rule should look something like this?

Rule {
Process {
Include OBJECT_NAME { -v "spoolsv.exe" }
}
Target {
Match FILE {
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\**\\New\\*.dll" }
Include OBJECT_NAME { -v "%systemroot%\\System32\\spool\\drivers\\**\\Old\\*\\*.dll" }
Exclude OBJECT_NAME {
-v "C:\\Windows\\System32\\spool\\\drivers\\x64\\3\\New\\FXS*.DLL"
-v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Old\\1\\FXS.DLL"
-v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\New\\LMUD1*.DLL"
-v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\New\\SendToOneNote*.dll"
-v "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\Old\\1\\SendToOneNote*.dll"
}
Include -access "CREATE"
}
}
}

[Daveb3d]

Yes.  That should work. For reference, you can similarly group the includes, but it isn't necessary.  

Dave

[youngs]

Great, Thanks again for your quick response.

Scott

[youngs]

@Daveb3d When grouping excludes is there a way to state the path and then just list out the files you want to exclude?  What I am finding is that we could end up with lots of exclusions and the expert rule is going to be long.  Is there a limit to how many exclusions you can add? 

Below is a sample of what we have currently been doing, just looking to see if there is a better way to handle exclusions 😃 

Exclude OBJECT_NAME {
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\New\\SendToOneNote*.dll"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\Old\\1\\SendToOneNote*.dll"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\New\\UNIDRVUI.DLL"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\Old\\1\\UNIDRVUI.DLL"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\New\\PrintConfig.dll"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\Old\\1\\PrintConfig.dll"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\New\\unidrv.dll"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\Old\\1\\unidrv.dll"
-v "C:\\Windows\\System32\\spool\\drivers\\*\\3\\New\\mxdwdrv.dll

Thanks again 

Scott

[Daveb3d]

You can just put the file names in, and then it will be path agnostic to the DRs defined in the inclusion statement.  

Dave

[youngs]

So something like this then?

Exclude OBJECT_NAME {
-v "SendToOneNote*.dll"
-v "UNIDRVUI.DLL"
-v "PrintConfig.dll"
}

Do you know if there is a limit to number of exclusions?

Thanks again for your quick response.

Scott

[Daveb3d]

Yes, that looks right.

And no... I mean eventually, it could become performance impacting, but some of my rules are monsters and they don't cause significant degradation. 

[youngs]

Does anyone know if you can use ? as wildcards for exclusions within an expert rule?

Something like this:  

Exclude OBJECT_NAME {

-v "123400???.DLL"

}

Which would include 1234A.dll, 1234AB.dll and 1234ABC.dll

Thanks

Scott

[Daveb3d]

Yes, that works.

Dave