Netskope Threat Labs

INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PrintNightmare download attempt

IPS-SWG

1 SID: 61288

First seen
June 2023
Last seen
September 2026

Detects the WinPWN Windows attack toolkit, which bundles credential dumping and privilege escalation modules. Spotting these indicators early helps contain an intrusion before cyberattackers expand access. The underlying flaw carries the identifier CVE-2021-1675.