
title: CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum
author: Sittikorn S
date: 2021/07/16
description: Detects patterns as noticed in exploitation of Windows CVE-2021-31979
  CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject:
    - '*\Software\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32*'
    - '*\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32*'
  SELECTION_5:
  - IMJPUEXP.DLL
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5)
falsepositives:
- Unlikely
id: 32b5db62-cb5f-4266-9639-0fa48376ac00
level: critical
logsource:
  category: registry_event
  product: windows
modified: 2021/09/09
references:
- https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
- https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
status: experimental
tags:
- attack.credential_access
- attack.t1566
- attack.t1203
- cve.2021.33771
- cve.2021.31979
ruletype: SIGMA
