CVE-2021-31979 CVE-2021-33771 Exploits

Status: test
Severity: critical
Log source: category registry_set, product windows
Author: Sittikorn S, frack113
Source: github.com/SigmaHQ/sigma

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing
Execution	`T1203` Exploitation for Client Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: CVE-2021-31979 CVE-2021-33771 Exploits
id: 32b5db62-cb5f-4266-9639-0fa48376ac00
status: test
description: Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
references:
    - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
    - https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
author: Sittikorn S, frack113
date: 2021-07-16
modified: 2023-08-17
tags:
    - attack.initial-access
    - attack.execution
    - attack.credential-access
    - attack.t1566
    - attack.t1203
    - cve.2021-33771
    - cve.2021-31979
    - detection.emerging-threats
    # - threat_group.Sourgum
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith:
            - CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
            - CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
    filter:
        Details|endswith:
            - system32\wbem\wmiutils.dll
            - system32\wbem\wbemsvc.dll
    condition: selection and not filter
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    TargetObject|endswith:
        - CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
        - CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)

Stage 2: `not filter`

filter:
    Details|endswith:
        - system32\wbem\wmiutils.dll
        - system32\wbem\wbemsvc.dll

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Details`	ends_with	`system32\wbem\wbemsvc.dll`	`excludes:Details` `field:"Details" value:"system32\wbem\wbemsvc.dll"`
`Details`	ends_with	`system32\wbem\wmiutils.dll`	`excludes:Details` `field:"Details" value:"system32\wbem\wmiutils.dll"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)` `CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)`	`field:"TargetObject" kind:ends_with`