Coverage › CVE-2021-31207

CVE-2021-31207 Mapped Sigma

Microsoft Exchange Server Security Feature Bypass Vulnerability

Vendor / product

Microsoft — Exchange Server

Description (CISA)

Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.

Added to KEV

2021-11-03

Due date

2021-11-17

Required action

Apply updates per vendor instructions.

Known ransomware use

Known

CWE

CWE-20, CWE-434

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2021-31207

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1548.002 Bypass User Account Control exploitation technique

• DET0388 Detection Strategy for T1548.002 – Bypass User Account Control (UAC)
  AN1094 Windows

  Detects a multi-event behavior chain involving UAC bypass attempts via known auto-elevated binaries (e.g., eventvwr.exe, sdclt.exe), unauthorized Registry changes to UAC-related keys, and anomalous process execution with elevated privileges but lacking standard parent-child lineage. Suspicious patterns include invocation of auto-elevated COM objects or manipulation of isolatedCommand Registry entries without consent prompts.

  WinEventLog:Security EventCode=4688 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  WinEventLog:Sysmon EventCode=13, 14 → DC0063 Windows Registry Key Modification

  WinEventLog:Sysmon EventCode=10 → DC0035 Process Access

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  Tunable: TimeWindow ElevatedProcessNameList ParentProcessAnomalyThreshold

Sigma rules tagged attack.t1548.002 (56)

All 56 rules on the technique page →

T1565 Data Manipulation primary impact

• DET0059 Detection Strategy for Data Manipulation
  AN0162 Windows

  Correlate unauthorized or anomalous file modifications, deletions, or metadata changes with suspicious process execution or API calls. Detect abnormal changes to structured data (e.g., database files, logs, financial records) outside expected business process activity.

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

  WinEventLog:Sysmon EventCode=15 → DC0059 File Metadata

  WinEventLog:Security EventCode=4663, 4670, 4656 → DC0055 File Access

  Tunable: MonitoredFilePaths TimeWindow AuthorizedProcesses
  AN0163 Linux

  Detect unauthorized manipulation of log files, database entries, or system configuration files through auditd and syslog. Correlate shell commands that alter HISTFILE or data-related processes with abnormal file access patterns.

  auditd:SYSCALL open, unlink, rename: Suspicious file access, deletion, or modification of sensitive paths → DC0061 File Modification

  linux:syslog Unexpected SQL or application log entries showing tampered or malformed data → DC0085 Network Traffic Content

  Tunable: WatchedDirectories CommandExclusions
  AN0164 macOS

  Detect manipulation of system or application files in /Library, /System, or user data directories using FSEvents and Unified Logs. Identify anomalous process execution modifying plist files, structured data, or logs outside expected update cycles.

  macos:unifiedlog Anomalous plist modifications or sensitive file overwrites by non-standard processes → DC0061 File Modification

  macos:osquery open, execve: Unexpected processes accessing or modifying critical files → DC0021 OS API Execution

  Tunable: AllowedPlistEditors FileIntegrityBaseline

Sigma rules tagged attack.t1565 (3)