Coverage › CVE-2021-33739

CVE-2021-33739 Mapped Sigma

Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability

Vendor / product

Microsoft — Windows

Description (CISA)

Microsoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.

Added to KEV

2021-11-03

Due date

2021-11-17

Required action

Apply updates per vendor instructions.

Known ransomware use

Unknown

CWE

none recorded by CISA

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2021-33739

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

2 mapping objects across 2 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1068 Exploitation for Privilege Escalation primary impact

• DET0514 Detection Strategy for Exploitation for Privilege Escalation
  AN1419 Windows

  Detects exploitation attempts targeting vulnerable kernel drivers or OS components, often followed by unusual process or token behavior.

  WinEventLog:Sysmon EventCode=6 → DC0079 Driver Load

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4672 → DC0088 Logon Session Metadata

  Tunable: DriverNamePattern TimeWindow ParentProcessPath
  AN1420 Linux

  Detects escalation via vulnerable setuid binaries or kernel modules, often chained with unusual access to /proc/kallsyms or /dev/kmem.

  auditd:SYSCALL execve → DC0032 Process Creation

  auditd:SYSCALL ACCESS → DC0035 Process Access

  auditd:SYSCALL dmesg → DC0016 Module Load

  Tunable: SetUIDBinaryList TimeWindow EffectiveUIDThreshold
  AN1421 macOS

  Detects use of vulnerable kernel extensions or entitlements abused via setuid or AppleScript injection chains.

  macos:unifiedlog process:exec and kext load events → DC0032 Process Creation

  macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_KEXTLOAD → DC0016 Module Load

  Tunable: EntitlementList TimeWindow
  AN1422 Containers

  Detects container breakout behavior via exploitation (e.g., DirtyPipe, CVE-2022-0847), followed by host OS interaction or escalated capability assignment.

  auditd:SYSCALL capset or setns → DC0067 Logon Session Creation

  containerd:runtime e.g., containerd, Docker events → DC0091 Container Enumeration

  Tunable: NamespaceEscapePattern TimeWindow

Sigma rules tagged attack.t1068 (31)

All 31 rules on the technique page →

T1598.002 Spearphishing Attachment exploitation technique

• DET0865 Detection of Spearphishing Attachment
  AN1997 PRE

  Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

  Network Traffic None → DC0078 Network Traffic Flow

  Application Log None → DC0038 Application Log Content

  Network Traffic None → DC0085 Network Traffic Content

Sigma rules tagged attack.t1598.002 (1)