| splunk |
Print Spooler Adding A Printer Driver |
production |
2026-05-13 |
| splunk |
Spoolsv Writing a DLL - Sysmon |
production |
2026-05-13 |
| splunk |
Spoolsv Writing a DLL |
production |
2026-05-13 |
| splunk |
Spoolsv Suspicious Process Access |
production |
2026-05-13 |
| splunk |
Spoolsv Spawning Rundll32 |
production |
2026-05-13 |
| splunk |
Print Spooler Failed to Load a Plug-in |
production |
2026-05-13 |
| sigma |
Malicious PowerShell Commandlets - ScriptBlock |
test |
2025-12-10 |
| sigma |
Malicious PowerShell Commandlets - ProcessCreation |
test |
2025-12-10 |
| sigma |
Malicious PowerShell Commandlets - PoshModule |
test |
2025-12-10 |
| sigma |
Possible PrintNightmare Print Driver Install - CVE-2021-1675 |
stable |
2025-11-03 |
| sigma |
Antivirus PrinterNightmare CVE-2021-34527 Exploit Detection |
stable |
2023-10-23 |
| sigma |
Suspicious Printer Driver Empty Manufacturer |
test |
2023-08-17 |
| sigma |
PrinterNightmare Mimikatz Driver Name |
test |
2023-06-12 |
| sigma |
Potential PrintNightmare Exploitation Attempt |
test |
2023-02-17 |
| sigma |
Suspicious Rejected SMB Guest Logon From IP |
test |
2023-01-02 |
| sigma |
CVE-2021-1675 Print Spooler Exploitation Filename Pattern |
test |
2022-12-25 |
| sigma |
Possible CVE-2021-1675 Print Spooler Exploitation |
test |
2022-11-15 |
| sigma |
CVE-2021-1675 Print Spooler Exploitation |
test |
2022-10-09 |
| sigma |
CVE-2021-1675 Print Spooler Exploitation IPC Access |
test |
2022-10-05 |
| sigma |
Windows Spooler Service Suspicious Binary Load |
test |
2022-06-02 |