Update MSRPRN_Printer_Bug_Exploitation.yaml

This commit is contained in:
Vasileios Paschalidis 2022-03-03 14:16:32 +02:00 коммит произвёл GitHub
Родитель 410fee42e2
Коммит fdf9cd34f6
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 0 добавлений и 1 удалений

Просмотреть файл

@ -4,7 +4,6 @@ description: |
'This query detects potential attempts to remotely access to the print spooler service on Active Directory Domain Controllers which could indicate an exploitation of MS-RPRN printer bug from a server that is configured with unconstrained delegation.
This query searches for the event id 5145 on Domain Controllers where the ShareName is "\\\*\IPC$" and the RelativeTargetName is "spoolss".
Ref: https://medium.com/@riccardo.ancarani94/exploiting-unconstrained-delegation-a81eabbd6976#:~:text=The%20exploitation%20of%20unconstrained%20delegation,system%20with%20the%20delegation%20enabled.&text=but%20before%20doing%20that%20we,listen%20for%20incoming%20authenticated%20connections.'
severity: High
requiredDataConnectors:
- connectorId: SecurityEvents
dataTypes: