Suspicious Printer Driver Empty Manufacturer

Title: Suspicious Printer Driver Empty Manufacturer
Status: test
Description:Detects a suspicious printer driver installation with an empty Manufacturer value
References:
  -https://twitter.com/SBousseaden/status/1410545674773467140
Author: Florian Roth (Nextron Systems)
Date: 2020-07-01
modified:2023-08-17
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574'
• -'cve.2021-1675'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains|all:
      -'\Control\Print\Environments\Windows x64\Drivers'
      -'\Manufacturer'

    Details: '(Empty)'
  filter_cutepdf:
    TargetObject|contains: '\CutePDF Writer v4.0\'
  filter_vnc:
    TargetObject|contains:
      -'\VNC Printer (PS)\'
      -'\VNC Printer (UD)\'

  filter_pdf24:
    TargetObject|contains: '\Version-3\PDF24\'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Alerts on legitimate printer drivers that do not set any more details in the Manufacturer value
Level: high