Emerging Threatcriticaltest

CVE-2021-31979 CVE-2021-33771 Exploits

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Sittikorn S, François HubautCreated Fri Jul 16Updated Thu Aug 1732b5db62-cb5f-4266-9639-0fa48376ac002021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|endswith:
            - CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
            - CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
    filter:
        Details|endswith:
            - system32\wbem\wmiutils.dll
            - system32\wbem\wbemsvc.dll
    condition: selection and not filter

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0001 · Initial Access TA0002 · Execution TA0006 · Credential Access

Techniques