PLAYBOOKSNETHOSTATTRIBDETECT
← all playbooks
EXPLOIT REFERENCE
PrintNightmare (CVE-2021-34527)
Every Windows machine runs the Print Spooler. Every domain user can exploit it. A single authenticated call to RpcAddPrinterDriverEx loads an attacker-supplied DLL as SYSTEM. Local privilege escalation and remote code execution from a service that was enabled by default, on every version, including domain controllers.
CVE-2021-34527 + CVE-2021-1675 · privilege escalation + RCE · spoolsv.exe · SYSTEM-level · Mimikatz / Metasploit integrated
Why PrintNightmare matters

The Print Spooler service (spoolsv.exe) is enabled by default on every Windows system, including domain controllers. PrintNightmare abuses the RpcAddPrinterDriverEx() function, which allows any authenticated user to install a printer driver. Because printer drivers execute as SYSTEM, an attacker loads a malicious DLL that runs with the highest privilege level. The exploit requires only a regular Domain User account: no admin, no special permissions.

Dual capability: CVE-2021-1675 was initially classified as local privilege escalation, then reclassified as RCE. CVE-2021-34527 was assigned as the RCE variant. In practice, both are used together. The local variant escalates to SYSTEM on the current host. The remote variant achieves SYSTEM on any reachable Windows host with the Spooler running, including domain controllers.

Domain controller impact: If the Print Spooler is running on a DC (which it is by default), a standard domain user can achieve SYSTEM on the DC remotely. From there: DCSync, Golden Ticket, full domain compromise. PrintNightmare on a DC is a one-step path from "authenticated user" to "owns the domain."

Patch alone was insufficient. Microsoft's initial July 2021 patch only addressed the RCE component. The local privilege escalation remained exploitable. Even after subsequent patches, the vulnerability persists on systems where Point and Print is enabled with NoWarningNoElevationOnInstall set to 1. Full remediation requires patching AND disabling Point and Print unsafe defaults AND disabling the Spooler on systems that don't need it (especially DCs).
The CVE family
Detection
Host-based detection (primary) Sysmon EID 1: spoolsv.exe spawning cmd.exe, powershell.exe, rundll32.exe, or any unexpected child process
Sysmon EID 11: DLL writes to C:\Windows\System32\spool\drivers\ by non-standard processes
Sysmon EID 7: DLL loaded by spoolsv.exe from non-standard paths
Security EID 4688: spoolsv.exe as parent process with command-line auditing enabled
Registry: monitor HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint for NoWarningNoElevationOnInstall = 1
Network-based detection Zeek/Suricata: anomalous MS-RPRN/MS-PAR RPC traffic to the Print Spooler on TCP 445
SMB traffic: DLL file transfers over SMB to the print driver staging path
Lateral pattern: authenticated SMB connections to port 445 followed immediately by spoolsv.exe child process creation on the target
  1. 1. Identify where the Print Spooler is running Audit every system: Get-Service Spooler | Where Status -eq Running. The Spooler should be disabled on all domain controllers, servers that don't need printing, and any system in a sensitive security zone. Every running Spooler instance is an attack surface. PowerShell: Get-Service Spooler · GPO: Computer Config > Windows Settings > System Services
  2. 2. Hunt for spoolsv.exe child processes Search Sysmon EID 1 for spoolsv.exe spawning: rundll32.exe (loading malicious DLL), cmd.exe, powershell.exe, whoami.exe, net.exe. Any child process from spoolsv.exe other than legitimate print-related operations is suspicious. HOST: T1068 · Sysmon EID 1: ParentImage contains spoolsv.exe
  3. 3. Check for DLL writes to driver paths Monitor C:\Windows\System32\spool\drivers\ for new or modified DLL files. Legitimate driver installations are infrequent and managed. A DLL appearing in this path outside a managed driver update is a high-confidence exploitation indicator. Sysmon EID 11 · FIM on spool\drivers\ · HOST: Persistence
  4. 4. Check Point and Print registry configuration Verify: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint. NoWarningNoElevationOnInstall must be 0 or undefined. UpdatePromptSettings must be 0 or undefined. If either is set to 1, the system remains exploitable even after patching. Registry audit · GPO verification · Sysmon EID 13 for registry changes
  5. 5. Monitor for RPC traffic to Spooler endpoints On the network: watch for MS-RPRN RPC calls over SMB (TCP 445) from hosts that don't normally interact with print services. The remote exploitation variant uses RpcAddPrinterDriverEx over the named pipe \spoolss. NET: Lateral Movement · Zeek: dce_rpc.log for spoolss endpoint
  6. 6. If exploitation confirmed: scope for domain compromise PrintNightmare gives SYSTEM. If exploited on a DC: assume the domain is compromised. Check for DCSync (Security EID 4662 with replication rights), Golden Ticket indicators, new privileged accounts, and credential dumping. If exploited on a member server: check for lateral movement using the SYSTEM-level credentials. HOST: T1003.006 DCSync · T1003.001 LSASS
Who uses PrintNightmare

Ransomware affiliates adopted PrintNightmare rapidly for privilege escalation after initial access. Vice Society, Magniber, and multiple RaaS affiliates incorporated it into their playbooks.
Mimikatz integrated PrintNightmare exploitation, making it available to every red team and every attacker who uses Mimikatz.
Metasploit added modules within days of disclosure, providing point-and-click exploitation.
APT actors including APT28 and Chinese-nexus groups have been observed leveraging Print Spooler vulnerabilities for privilege escalation in post-compromise operations.

Related playbooks

Hybrid AD Enterprise (DC compromise path)
Ransomware Detected (PrintNightmare as a privilege escalation step)
Living-off-the-Land Activity (spoolsv.exe is a legitimate service being abused)
EternalBlue (same pattern: a default Windows service that becomes a universal attack surface)