Windows file event detection for CVE-2021-31979 and CVE-2021-33771 exploitation artifact paths
Flags Windows file events where the target filename matches paths tied to CVE-2021-31979/CVE-2021-33771 exploitation patterns.
- Product
- windows
- Category
- file_event
- Author
- Sittikorn S (SigmaHQ), DRL 1.1
- Published
- 2021-07-16
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation or access events matching specific target file paths associated with exploitation activity around CVE-2021-31979 and CVE-2021-33771. Attackers may leverage these artifacts to establish or execute malicious components during initial access and follow-on actions. It relies on Windows file event telemetry that includes the full target filename for the matched paths.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
- citizenlab.cahttps://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-33771/file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows file event detection for CVE-2021-31979 and CVE-2021-33771 exploitation artifact paths
id: ef2e6a93-d3e2-448e-a3ea-4992c079c189
status: test
description: This rule flags Windows file creation or access events matching specific target file paths associated with exploitation activity around CVE-2021-31979 and CVE-2021-33771. Attackers may leverage these artifacts to establish or execute malicious components during initial access and follow-on actions. It relies on Windows file event telemetry that includes the full target filename for the matched paths.
references:
- https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
- https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-33771/file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml
author: Sittikorn S, Huntrule Team
date: 2021-07-16
modified: 2022-10-09
tags:
- attack.initial-access
- attack.execution
- attack.credential-access
- attack.t1566
- attack.t1203
- cve.2021-33771
- cve.2021-31979
- detection.emerging-threats
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains:
- C:\Windows\system32\physmem.sys
- C:\Windows\System32\IME\IMEJP\imjpueact.dll
- C:\Windows\system32\ime\IMETC\IMTCPROT.DLL
- C:\Windows\system32\ime\SHARED\imecpmeid.dll
- C:\Windows\system32\config\spp\ServiceState\Recovery\pac.dat
- C:\Windows\system32\config\cy-GB\Setup\SKB\InputMethod\TupTask.dat
- C:\Windows\system32\config\config\startwus.dat
- C:\Windows\system32\ime\SHARED\WimBootConfigurations.ini
- C:\Windows\system32\ime\IMEJP\WimBootConfigurations.ini
- C:\Windows\system32\ime\IMETC\WimBootConfigurations.ini
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: ad7085ac-92e4-4b76-8ce2-276d2c0e68ef
type: derived