CVE-2021-31979 CVE-2021-33771 Exploits

 1title: CVE-2021-31979 CVE-2021-33771 Exploits
 2id: 32b5db62-cb5f-4266-9639-0fa48376ac00
 3status: test
 4description: Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
 5references:
 6    - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
 7    - https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
 8author: Sittikorn S, frack113
 9date: 2021-07-16
10modified: 2023-08-17
11tags:
12    - attack.initial-access
13    - attack.execution
14    - attack.credential-access
15    - attack.t1566
16    - attack.t1203
17    - cve.2021-33771
18    - cve.2021-31979
19    - detection.emerging-threats
20    # - threat_group.Sourgum
21logsource:
22    product: windows
23    category: registry_set
24detection:
25    selection:
26        TargetObject|endswith:
27            - CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
28            - CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
29    filter:
30        Details|endswith:
31            - system32\wbem\wmiutils.dll
32            - system32\wbem\wbemsvc.dll
33    condition: selection and not filter
34falsepositives:
35    - Unlikely
36level: critical

References

• Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware | Microsoft Security Blog

  

  The Microsoft Threat Intelligence Center (MSTIC) alongside the Microsoft Security Response Center (MSRC) has uncovered a private-sector offensive actor, or PSOA, that we are calling SOURGUM in possession of now-patched, Windows 0-day exploits (CVE-2021-31979 and CVE-2021-33771).

  
  Read More

• Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus - The Citizen Lab

  

  Candiru is a secretive Israel-based company that sells spyware exclusively to governments. Using Internet scanning, we identified more than 750 websites linked to Candiru’s spyware infrastructure. We found many domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter movement, as well as media companies, and other civil-society themed entities.

  
  Read More

Related rules

• CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum
• Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE
• Exploit for CVE-2017-0261
• Exploit for CVE-2017-8759
• CVE-2024-50623 Exploitation Attempt - Cleo