SecBoard
Zurück zur CVE-Übersicht

CVE-2026-120422

NONE
Risk Signal Score5/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.4%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.

Erkennung & Indikatoren

Ausnutzung

ESET beobachtete, dass die DarkVigil-Implantate ab dem 1. Juli 2026, drei Tage nach der Veröffentlichung der sauberen Version von QuickFox, über die Sogou Input Method-Komponente SGTool.exe gestartet wurden. Die Operation zielte auf Organisationen und chinesischsprachige Personen in Hongkong, Thailand, Japan, Vietnam, Oman und Sri Lanka ab.

Behobene Versionen

  • 16.10

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName == "SGTool.exe"
| where InitiatingProcessFileName == "SogouInput.exe" or InitiatingProcessCommandLine contains "SogouInput"
| where RemoteUrl contains "http://" // Look for unencrypted HTTP connections
| where RemoteUrl contains "config" or RemoteUrl contains "update" // Refine based on configuration/update retrieval
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteUrl, InitiatingProcessParentFileName, InitiatingProcessParentCommandLine
| join kind=leftouter (
    DeviceFileEvents
    | where FolderPath contains "SogouInput"
    | where ActionType == "FileCreated"
    | where FileName has_any (".dll", ".exe", ".sys") // Look for suspicious file types being downloaded
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256
) on DeviceName
| where Timestamp between (ago(7d) .. now()) // Adjust time range as needed
| summarize by Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteUrl, InitiatingProcessParentFileName, InitiatingProcessParentCommandLine, FolderPath, SHA256
| order by Timestamp desc

Splunk SPL

sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 (Image="*\\SGTool.exe" OR ParentImage="*\\SGTool.exe")
| eval CommandLine = coalesce(CommandLine, OriginalFileName)
| search (ParentImage="*\\SogouInput.exe" OR ParentCommandLine="*SogouInput*")
| search CommandLine="*http://*" (CommandLine="*config*" OR CommandLine="*update*")
| join type=left (
    sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11 (TargetFilename="*\\SogouInput\\*" AND (TargetFilename="*.dll" OR TargetFilename="*.exe" OR TargetFilename="*.sys"))
    | fields _time, ComputerName, TargetFilename, Hash
)
| table _time, ComputerName, Image, CommandLine, ParentImage, ParentCommandLine, TargetFilename, Hash
| sort -_time

Sigma

title: Sogou Input Method Insecure Configuration Retrieval
id: cve-2026-120422-sogou-insecure-config
status: experimental
description: Detects potential exploitation of CVE-2026-120422 in Sogou Input Method where SGTool.exe retrieves configuration over unencrypted HTTP, leading to arbitrary code execution.
references:
    - https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/
author: SecBoard
date: 2026/11/04
logsource:
    category: process_creation
    product: windows
detection:
    selection_sgtool:
        Image|endswith: '\SGTool.exe'
    selection_parent_sogou:
        ParentImage|endswith: '\SogouInput.exe'
        ParentCommandLine|contains: 'SogouInput'
    selection_http_config:
        CommandLine|contains:
            - 'http://'
            - 'config'
            - 'update'
    condition: all of selection_sgtool and any of selection_parent_sogou and all of selection_http_config
falsepositives:
    - Legitimate unencrypted configuration retrieval (if not patched)
level: high
---
title: Sogou Input Method Suspicious File Download
id: cve-2026-120422-sogou-suspicious-download
status: experimental
description: Detects suspicious file creations in Sogou Input Method directories, potentially linked to CVE-2026-120422 exploitation.
references:
    - https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/
author: SecBoard
date: 2026/11/04
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains: '\SogouInput\'
    selection_file_type:
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
            - '.sys'
    condition: all of selection_path and all of selection_file_type
falsepositives:
    - Legitimate application updates or installations
level: medium

Elastic ES|QL

from process where process.executable : "*\\SGTool.exe"
  and (process.parent.executable : "*\\SogouInput.exe" or process.parent.command_line : "*SogouInput*")
  and process.command_line : "*http://*"
  and (process.command_line : "*config*" or process.command_line : "*update*")
| join kind=left outer (
    from file where file.path : "*\\SogouInput\\*"
      and (file.path : "*.dll" or file.path : "*.exe" or file.path : "*.sys")
      and event.action : "file_created"
  ) on host.name
| project timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line, file.path, file.hash.sha256
| sort by timestamp desc

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen