CVE-2021-1675 osquery Script for Domain Controllers

domaincontrollersvulnerable_to_cve-2021-1675.sql

SELECT CASE cnt
           WHEN 2 THEN "TRUE"
           ELSE "FALSE"
       END "Vulnerable"
FROM
  (SELECT name,
          start_type,
          COUNT(name) AS cnt
   FROM services
   WHERE name = 'NTDS' or (name = 'Spooler' and start_type <> 'DISABLED'))
WHERE Cnt = 2;