Threat Hunting Exercise: Analyzing Windows PrintNightmare Print Spooler Exploitation Dataset

This hunt uses a simulated endpoint dataset (windows_printnightmare_2022-08-11T133000.json) capturing T1068: Exploitation for Privilege Escalation via PrintNightmare (CVE-2021-34527), where an attacker abuses the Print Spooler RPC interface (RpcAddPrinterDriverEx) to load an arbitrary, attacker-supplied DLL as SYSTEM.

Step 1: Hypothesis Formation

Hypothesis: The Print Spooler service (spoolsv.exe) loads a DLL driver from an unusual location shortly after a remote or local AddPrinterDriverEx RPC call, resulting in a new SYSTEM-level child process - consistent with PrintNightmare exploitation rather than legitimate printer driver installation. Indicators:

spoolsv.exe loads a DLL from a user-writable path (e.g., %SystemRoot%\System32\spool\drivers\x64\3\) that was written to disk only seconds earlier.
The loaded DLL is unsigned or has a mismatched/self-signed certificate.
spoolsv.exe (running as SYSTEM) spawns a child process shortly after the DLL load - spoolers do not normally spawn shells.
The driver installation was triggered via RPC from a remote host or a low-privileged local session, not through the standard "Add Printer" UI wizard by an administrator.

Null Hypothesis: A help-desk technician is legitimately installing a new printer driver package via Point and Print. Invalidate by confirming the driver publisher against the approved driver catalog and checking for a corresponding change ticket.

Rationale: PrintNightmare is a critical, widely-exploited SYSTEM privilege-escalation path that continues to appear in environments with delayed patching; this hunt validates spooler-DLL-load and post-load-process-spawn correlation as a detection layer that works even against unpatched hosts.

Step 2: Data Sources and Scope

Sources: Sysmon Event ID 7 (Image/DLL Load) for spoolsv.exe; Sysmon Event ID 1 (Process Creation, spoolsv.exe as parent); Print Service Operational Event Log (Event ID 316 - driver install); Network logs for remote RPC callers.
Scope: ~2022-08-11T13:30:00-13:31:30 UTC; Host: SRV-PRINT-003 (10.190.1.9); RPC caller: 10.190.5.201 (WKS-CONTRACT-004, a standard domain user session).
SIEM Queries (Splunk/ELK):
index=sysmon EventCode=7 Image="spoolsv.exe" ImageLoaded="spool\\drivers" | table _time Computer ImageLoaded Signed
index=sysmon EventCode=1 ParentImage="spoolsv.exe" | table _time Computer Image CommandLine
Driver install event: index=wineventlog source="Microsoft-Windows-PrintService/Operational" EventCode=316

Step 3: Key Findings

Parsed events (5 shown) confirm a remote RPC call from a standard user session triggered spoolsv.exe to load an unsigned DLL, which then spawned a SYSTEM-level command shell.

Timestamp (UTC)	Host	Event	Detail	IOC/Why Suspicious?
2022-08-11 13:30:02	SRV-PRINT-003	PrintService/Operational 316	Driver install request via RPC from 10.190.5.201, driver name "Xerox WC 7845 v5.1 (spoofed)"	RPC IOC: driver install triggered remotely by a non-admin session, not via the local Add Printer wizard.
2022-08-11 13:30:05	SRV-PRINT-003	File Create	`C:\Windows\System32\spool\drivers\x64\3\new\evil.dll` written moments before load	Timing IOC: the DLL exists on disk for less than 3 seconds before being loaded - inconsistent with a genuine, previously-validated driver package.
2022-08-11 13:30:06	SRV-PRINT-003	Sysmon 7 - Image Load	`spoolsv.exe` loads `evil.dll`, Signed=false	Signature IOC: unsigned DLL loaded by a SYSTEM service - legitimate print drivers from major vendors are code-signed.
2022-08-11 13:30:07	SRV-PRINT-003	Sysmon 1 - Process Create	`spoolsv.exe` (SYSTEM) spawns `cmd.exe /c net user backdoor P@ssw0rd! /add`	Privilege-Escalation IOC: Print Spooler never legitimately spawns shell processes; this confirms arbitrary code execution as SYSTEM.
2022-08-11 13:30:09	SRV-PRINT-003	Sysmon 1 - Process Create	`net localgroup Administrators backdoor /add`	Impact IOC: newly-created local account immediately elevated to local Administrators - the ultimate goal of the exploitation.

Validation:

Timeline: remote RPC driver install, near-instant unsigned DLL load, and SYSTEM-level shell spawning local admin account creation, all within 7 seconds - matches published PrintNightmare proof-of-concept exploit chains precisely.
False Positives: no change ticket authorizes a driver install on SRV-PRINT-003; the "Xerox" driver name does not match any entry in the approved driver catalog, and the DLL is unsigned.
Correlation: RPC source, DLL signature status, and immediate SYSTEM shell/account creation together are conclusive, unambiguous evidence of exploitation.

Step 4: Recommendations & Next Steps

Immediate Response: Disable the Print Spooler service on SRV-PRINT-003 (and any non-print-server hosts) immediately; remove the "backdoor" local account; isolate the host for forensic imaging; confirm the July 2021 PrintNightmare patch (or Point and Print restriction policy) is applied fleet-wide.
Detection: Sigma-style rule: title: PrintNightmare - Spoolsv Spawns Shell After Unsigned DLL Load → selection: (EventID=7 AND Image="spoolsv.exe" AND Signed=false) followed by (EventID=1 AND ParentImage="spoolsv.exe" AND Image IN (cmd.exe, powershell.exe)).
Pro Tip: Beyond patching, set RestrictDriverInstallationToAdministrators via Group Policy and disable inbound printing from untrusted networks - patching alone has repeatedly proven insufficient given the multiple PrintNightmare/Point-and-Print variants discovered after the initial CVE.

Hypothesis confirmed - an attacker exploited the PrintNightmare Print Spooler vulnerability via a remote RPC call to load an unsigned DLL and escalate to SYSTEM, creating a persistent local administrator backdoor!