Print

Overview

The red team executed a PrintNightmare-style exploit against a vulnerable Windows Print Spooler service. As the detection analyst, the task is to extract artifacts from network captures and Windows event logs to build detection rules for the SOC. This lab covers SMB file transfer analysis, Sysmon event correlation, and reverse shell identification.

Network Analysis — Identifying the Attacker

Opening the PCAP in Wireshark and checking Statistics → Conversations establishes the two key hosts:

• Victim: 192[.]168[.]0[.]15 (10.0.2.15)
• Attacker: 10[.]0[.]2[.]5 To identify the domain name used by the red team, filtering for NTLMSSP authentication traffic reveals the attacker’s domain:

redteam.lab

NTLMSSP is a goldmine for domain enumeration during network forensics — it exposes workstation names, domain names, and usernames in cleartext within the authentication handshake.

SMB File Transfer — printevil.dll

Filtering for SMB2 traffic from the attacker:

ip.addr == 10.0.2.5 && smb2

The traffic reveals the attacker serving a malicious DLL over an SMB share:

\\10.0.2.5\smb\printevil.dll

The victim host connects to the attacker’s SMB share and pulls the DLL — this is the core of the PrintNightmare exploit, abusing the Windows Print Spooler’s ability to load printer drivers from remote UNC paths.

System Event Logs — DLL Drop Location

Pivoting to the Windows System event logs, Event ID 11 (file creation) records exactly where the spooler dropped the malicious DLL:

C:\Windows\System32\spool\drivers\x64\3\New\printevil.dll

This path is the standard staging location for printer drivers — the exploit tricks the spooler into loading attacker-controlled code from here with SYSTEM privileges.

Security Log — Spoolss Access

Checking the Security event log for lateral movement indicators, filtering for AccountName=printuser and RelativeTargetName=spoolss surfaces the key event:

• Event ID: 5145 — A network share object was checked for access
• AccessMask: 0x3
• ShareName: \\*\IPC$ Event 5145 is critical for PrintNightmare detection — it records the attacker authenticating to the IPC$ share and accessing the spoolss named pipe, which is the mechanism used to trigger remote DLL loading via the RpcAddPrinterDriverEx call.

Reverse Shell — C2 Callback

Once printevil.dll is loaded by the spooler service running as NT AUTHORITY\SYSTEM, the DLL executes and establishes a reverse shell back to the attacker over HTTPS (port 443) to blend into legitimate traffic:

10[.]0[.]2[.]5:443

Using port 443 for C2 is a common evasion technique — most network monitoring tools whitelist outbound HTTPS, making the reverse shell callback difficult to distinguish from normal web traffic without deep packet inspection.

Sysmon — WerFault.exe Parent Process

The exploit’s DLL injection into the spooler process causes instability, triggering Windows Error Reporting. Examining the Sysmon logs for WerFault.exe reveals its parent process:

c:\Windows\system32\spoolsv.exe

spoolsv.exe spawning WerFault.exe is an anomalous and detectable indicator — under normal operation the print spooler should not be crashing. This parent-child relationship is a strong detection opportunity for PrintNightmare exploitation attempts.

Post-Exploitation — Whoami

With a SYSTEM shell established, the attacker’s first command confirms their privilege level:

whoami

Output: nt authority\system

Full SYSTEM access achieved via the print spooler service — no privilege escalation required since spoolsv.exe already runs as SYSTEM.

IOCs