Emerging Threatcriticaltest

CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum

Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Sittikorn SCreated Fri Jul 16Updated Sun Oct 09ad7085ac-92e4-4b76-8ce2-276d2c0e68ef2021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|contains:
            - 'C:\Windows\system32\physmem.sys'
            - 'C:\Windows\System32\IME\IMEJP\imjpueact.dll'
            - 'C:\Windows\system32\ime\IMETC\IMTCPROT.DLL'
            - 'C:\Windows\system32\ime\SHARED\imecpmeid.dll'
            - 'C:\Windows\system32\config\spp\ServiceState\Recovery\pac.dat'
            - 'C:\Windows\system32\config\cy-GB\Setup\SKB\InputMethod\TupTask.dat'
            - 'C:\Windows\system32\config\config\startwus.dat'
            - 'C:\Windows\system32\ime\SHARED\WimBootConfigurations.ini'
            - 'C:\Windows\system32\ime\IMEJP\WimBootConfigurations.ini'
            - 'C:\Windows\system32\ime\IMETC\WimBootConfigurations.ini'
    condition: selection