Windows Registry InprocServer32 CLSID Targets Indicative of CVE-2021-31979/33771 Exploitation

title: Windows Registry InprocServer32 CLSID Targets Indicative of CVE-2021-31979/33771 Exploitation
id: 3d69db85-2135-4263-a7a9-531c61f64b90
status: test
description: This rule matches Windows registry set activity targeting specific CLSID InprocServer32 (Default) paths associated with exploitation patterns for CVE-2021-31979 and CVE-2021-33771. Attackers can use COM/InprocServer32 registration changes to redirect execution to malicious code without dropping obvious binaries. Telemetry is based on registry_set events capturing the TargetObject path, with exclusions for specific WMI DLL values to reduce benign matches.
references:
  - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
  - https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-33771/registry_set_cve_2021_31979_cve_2021_33771_exploits.yml
author: Sittikorn S, frack113, Huntrule Team
date: 2021-07-16
modified: 2023-08-17
tags:
  - attack.initial-access
  - attack.execution
  - attack.credential-access
  - attack.t1566
  - attack.t1203
  - cve.2021-33771
  - cve.2021-31979
  - detection.emerging-threats
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith:
      - CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
      - CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
  filter:
    Details|endswith:
      - system32\wbem\wmiutils.dll
      - system32\wbem\wbemsvc.dll
  condition: selection and not filter
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 32b5db62-cb5f-4266-9639-0fa48376ac00
    type: derived