Sigma rule: SOURGUM Actor Behaviours

Rule

Title

SOURGUM Actor Behaviours

Status

test

Level

high

Author

MSTIC, FPT.EagleEye

Date

2021-06-15

Modified

2022-10-09

File

rules-emerging-threats/2021/TA/SOURGUM/proc_creation_win_apt_sourgrum.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Log source

product

windows

category

process_creation

Detection

selection:
    Image|contains:
        - 'windows\system32\Physmem.sys'
        - 'Windows\system32\ime\SHARED\WimBootConfigurations.ini'
        - 'Windows\system32\ime\IMEJP\WimBootConfigurations.ini'
        - 'Windows\system32\ime\IMETC\WimBootConfigurations.ini'
registry_image:
    Image|contains:
        - 'windows\system32\filepath2'
        - 'windows\system32\ime'
    CommandLine|contains: 'reg add'
registry_key:
    CommandLine|contains:
        - 'HKEY_LOCAL_MACHINE\software\classes\clsid\{7c857801-7381-11cf-884d-00aa004b2e24}\inprocserver32'
        - 'HKEY_LOCAL_MACHINE\software\classes\clsid\{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}\inprocserver32'
condition: selection or all of registry_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.t1546
• attack.t1546.015
• attack.persistence
• attack.privilege-escalation
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1546
• T1546.015

References

• https://www.virustotal.com/gui/file/c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d/detection
• https://github.com/Azure/Azure-Sentinel/blob/43e9be273dca321295190bfc4902858e009d4a35/Detections/MultipleDataSources/SOURGUM_IOC.yaml
• https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/TA/SOURGUM/proc_creation_win_apt_sourgrum.yml