Windows Registry Modification Indicative of CVE-2021-31979 and CVE-2021-33771 Exploitation
Flags registry changes to targeted COM InprocServer32 CLSID paths tied to CVE-2021-31979/33771 exploitation behavior on Windows.
- Product
- windows
- Category
- registry_set
- Author
- Sittikorn S, frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-07-16
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows registry set activity where specific CLSID InprocServer32 Default values are written, matching observed patterns tied to exploitation attempts involving CVE-2021-31979 and CVE-2021-33771. Attackers can use these registry changes to coerce COM components to load attacker-controlled in-process DLLs. The detection relies on registry_set telemetry including the TargetObject path and associated value being set, and it excludes cases ending in system32\wbem\wmiutils.dll and system32\wbem\wbemsvc.dll.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
- citizenlab.cahttps://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-33771/registry_set_cve_2021_31979_cve_2021_33771_exploits.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Modification Indicative of CVE-2021-31979 and CVE-2021-33771 Exploitation
id: 3d69db85-2135-4263-a7a9-531c61f64b90
status: test
description: This rule flags Windows registry set activity where specific CLSID InprocServer32 Default values are written, matching observed patterns tied to exploitation attempts involving CVE-2021-31979 and CVE-2021-33771. Attackers can use these registry changes to coerce COM components to load attacker-controlled in-process DLLs. The detection relies on registry_set telemetry including the TargetObject path and associated value being set, and it excludes cases ending in system32\wbem\wmiutils.dll and system32\wbem\wbemsvc.dll.
references:
- https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
- https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-33771/registry_set_cve_2021_31979_cve_2021_33771_exploits.yml
author: Sittikorn S, frack113, Huntrule Team
date: 2021-07-16
modified: 2023-08-17
tags:
- attack.initial-access
- attack.execution
- attack.credential-access
- attack.t1566
- attack.t1203
- cve.2021-33771
- cve.2021-31979
- detection.emerging-threats
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|endswith:
- CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)
- CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)
filter:
Details|endswith:
- system32\wbem\wmiutils.dll
- system32\wbem\wbemsvc.dll
condition: selection and not filter
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 32b5db62-cb5f-4266-9639-0fa48376ac00
type: derived