Hi Community
I need some help in creating an XQL query for a BIOC which detects exploitation attempts for CVE-2021-1675 (printnightmare). So far I have the following two queries:
1. A query that detects incoming connections on port 445
dataset = xdr_data
| filter event_type = NETWORK and event_sub_type = NETWORK_STREAM_ACCEPT and (action_local_port = 139 or action_local_port = 445)
| fields event_type, agent_hostname as Hostname, action_local_ip as Local_IP, action_remote_ip as Remote_IP, action_external_hostname as Remote_Host, action_local_port as Local_Port, actor_process_image_name as Process_Getting_Connection
2. a query to view driverinstallations done by the print spooler service
dataset = xdr_data
| filter causality_actor_process_image_path = "C:\Windows\System32\spoolsv.exe" and actor_process_image_path = "C:\Windows\System32\drvinst.exe"
| fields agent_hostname as host_name, causality_actor_process_image_name as CGO_Name, causality_actor_process_image_path as CGO_Path, causality_actor_process_command_line as CGO_CMD, causality_actor_primary_username as Username, actor_process_image_path as child_path, actor_process_command_line as child_cmd, actor_process_os_pid as child_pid, actor_process_image_sha256 as child_sha256, actor_process_execution_time as start_date, event_id
Now I'd like to combine them somehow in order so get an alert for incoming connections over SMB which result in a driverinstallation done by the print spooler service. Has anyone done something similar or is able to help me with this XQL query?
Thanks in advance,
Remo
... View more
