
title: CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum
author: Sittikorn S
date: 2021/07/16
description: Detects patterns as noticed in exploitation of Windows CVE-2021-31979
  CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    TargetFilename:
    - '*C:\Windows\system32\physmem.sys*'
    - '*C:\Windows\System32\IME\IMEJP\imjpueact.dll*'
    - '*C:\Windows\system32\ime\IMETC\IMTCPROT.DLL*'
    - '*C:\Windows\system32\ime\SHARED\imecpmeid.dll*'
    - '*C:\Windows\system32\config\spp\ServiceState\Recovery\pac.dat*'
    - '*C:\Windows\system32\config\cy-GB\Setup\SKB\InputMethod\TupTask.dat*'
    - '*C:\Windows\system32\config\config\startwus.dat*'
    - '*C:\Windows\system32\ime\SHARED\WimBootConfigurations.ini*'
    - '*C:\Windows\system32\ime\IMEJP\WimBootConfigurations.ini*'
    - '*C:\Windows\system32\ime\IMETC\WimBootConfigurations.ini*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Unlikely
id: ad7085ac-92e4-4b76-8ce2-276d2c0e68ef
level: critical
logsource:
  category: file_event
  product: windows
modified: 2021/09/09
references:
- https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
- https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
status: experimental
tags:
- attack.credential_access
- attack.t1566
- attack.t1203
- cve.2021.33771
- cve.2021.31979
ruletype: SIGMA
