CVE-2026-51990: Tencent Sogou Input Method Exploited to Deploy GrayRabbit Malware — Detection and Remediation Guide

---
title: Sogou Input Method Process Spawning Command Shell or Script Interpreter
id: 3f8c1a72-5b94-4e21-9d6c-8a7f2e1b4c55
status: experimental
description: Detects Sogou Input Method components spawning cmd, PowerShell, wscript, rundll32, or mshta — consistent with CVE-2026-51990 exploitation delivering the GrayRabbit backdoor via the IME's trusted process context.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/14
tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\SogouInput\'
      - '\SogouPY.exe'
      - '\SogouCloud.exe'
      - '\SGTool.exe'
      - '\SogouExe.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Sogou component behavior — verify against vendor update cycles
level: high
---
title: Sogou Input Method Dropping Executable to User-Writable Path
id: 91d2e4b6-3c47-4a58-b1f9-6e8d0a5c7f22
status: experimental
description: Detects Sogou IME processes writing PE files to user-writable directories (AppData, Temp, ProgramData), consistent with GrayRabbit staging behavior following CVE-2026-51990 exploitation.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/05/14
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|contains:
      - '\SogouInput\'
      - '\SogouPY.exe'
      - '\SogouCloud.exe'
      - '\SGTool.exe'
  selection_path:
    TargetFilename|contains:
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
  condition: selection_image and selection_path and selection_ext
falsepositives:
  - Sogou self-update writing components to ProgramData — correlate with official update windows and validate hashes against vendor-signed binaries
level: medium
---
title: Sogou Input Method Network Connection to Non-Vendor Infrastructure
id: c47a2f18-8e63-4d05-a3b1-2f9e6d4c8a77
status: experimental
description: Detects Sogou IME processes establishing outbound connections to rare or non-Tencent destinations — potential GrayRabbit C2 channel proxied through the IME's trusted network context. Requires tuning of known Sogou/Tencent CDN ranges.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/05/14
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\SogouInput\'
      - '\SogouPY.exe'
      - '\SogouCloud.exe'
      - '\SGTool.exe'
  filter_vendors:
    DestinationHostname|contains:
      - '.sogou.com'
      - '.sogoucdn.com'
      - '.tencent.com'
      - '.qq.com'
  condition: selection and not filter_vendors
falsepositives:
  - Sogou cloud prediction and dictionary sync hitting third-party CDNs — build a baseline of observed destinations before raising severity
level: medium

// Hunt 1: Sogou IME processes spawning suspicious children (GrayRabbit staging)
let sogouProc = dynamic(["sogoupy.exe","sogoucloud.exe","sgtool.exe","sogouexe.exe"]);
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe","mshta.exe","regsvr32.exe","bitsadmin.exe","certutil.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (sogouProc)
   or InitiatingProcessFolderPath has "SogouInput"
| where FileName has_any (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          ParentProcess = InitiatingProcessFileName,
          ParentCmdLine = InitiatingProcessCommandLine,
          ChildProcess = FileName,
          ChildCmdLine = ProcessCommandLine,
          SHA256, FolderPath
| order by TimeGenerated desc;

// Hunt 2: Sogou-named binaries executing from non-standard paths or unsigned
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName has_any (dynamic(["sogoupy.exe","sogoucloud.exe","sgtool.exe","sogouexe.exe"]))
| where FolderPath !has "SogouInput"
| join kind=leftouter (
    DeviceFileCertificateInfo
    | where TimeGenerated > ago(14d)
    | summarize arg_max(TimeGenerated, IsSigned, Signer) by SHA1
) on $left.SHA1 == $right.SHA1
| project TimeGenerated, DeviceName, FolderPath, FileName, ProcessCommandLine, IsSigned, Signer
| order by TimeGenerated desc;

// Hunt 3: Sogou processes beaconing to rare network destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (dynamic(["sogoupy.exe","sogoucloud.exe","sgtool.exe","sogouexe.exe"]))
   or InitiatingProcessFolderPath has "SogouInput"
| where isnotempty(RemoteUrl)
| where RemoteUrl !has_any (dynamic(["sogou.com","sogoucdn.com","tencent.com","qq.com"]))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
          by RemoteUrl, RemoteIP, RemotePort, DeviceName, InitiatingProcessFileName
| order by ConnectionCount asc;

-- Hunt: Sogou IME process execution and network artifacts (GrayRabbit / CVE-2026-51990)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)sogou|sgtool'
   OR Exe =~ '(?i)SogouInput'

-- Follow-up: enumerate network connections held by Sogou processes
SELECT Pid, Name, Family, Type, Status,
       Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Name =~ '(?i)sogou|sgtool'

-- Follow-up: enumerate recently created executables/DLLs in Sogou install and staging dirs
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files*/SogouInput/**',
  'C:/Users/*/AppData/**/*.exe',
  'C:/ProgramData/**/*.dll'
])
WHERE Mtime > now() - 1209600
ORDER BY Mtime DESC

# CVE-2026-51990 - Sogou Input Method exposure audit and remediation aid
$ErrorActionPreference = 'SilentlyContinue'

Write-Host "=== Sogou Input Method Exposure Audit ===" -ForegroundColor Cyan

# 1. Inventory installed Sogou products via registry uninstall keys
$paths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
           'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*')
$sogouApps = Get-ItemProperty $paths | Where-Object { $_.DisplayName -match 'Sogou|搜狗' } |
             Select-Object DisplayName, DisplayVersion, InstallLocation, Publisher
if ($sogouApps) {
    Write-Host "[!] Sogou Input Method detected on this host:" -ForegroundColor Yellow
    $sogouApps | Format-Table -AutoSize
    Write-Host "[!] Verify installed version against Tencent's patched release for CVE-2026-51990." -ForegroundColor Yellow
} else {
    Write-Host "[+] No Sogou Input Method installation found via uninstall registry." -ForegroundColor Green
}

# 2. Detect running Sogou processes and flag suspicious child processes
$sogouProcs = Get-Process | Where-Object { $_.Name -match 'sogou|sgtool' }
if ($sogouProcs) {
    Write-Host "[!] Active Sogou processes:" -ForegroundColor Yellow
    $sogouProcs | Select-Object Id, Name, Path | Format-Table -AutoSize
    foreach ($p in $sogouProcs) {
        Get-CimInstance Win32_Process -Filter "ParentProcessId = $($p.Id)" |
            Where-Object { $_.Name -match 'cmd|powershell|wscript|cscript|rundll32|mshta|regsvr32' } |
            ForEach-Object {
                Write-Host "[ALERT] Sogou process $($p.Name) (PID $($p.Id)) spawned suspicious child: $($_.Name) :: $($_.CommandLine)" -ForegroundColor Red
            }
    }
}

# 3. List recent network connections from Sogou processes for review
$sogouProcs | ForEach-Object {
    Get-NetTCPConnection -OwningProcess $_.Id -State Established |
        Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
} | Sort-Object -Unique | Format-Table -AutoSize

# 4. OPTIONAL: Block Sogou binaries at the firewall pending patch validation
# Uncomment only after change-control approval.
# Get-ChildItem 'C:\Program Files (x86)\SogouInput' -Recurse -Filter *.exe | ForEach-Object {
#     New-NetFirewallRule -DisplayName "BLOCK-Sogou-CVE-2026-51990-$($_.BaseName)" `
#         -Direction Outbound -Program $_.FullName -Action Block | Out-Null
# }
# Write-Host "Outbound firewall blocks applied to Sogou binaries." -ForegroundColor Yellow

# 5. OPTIONAL: Uninstall (validate against your software policy first)
# $sogouApps | ForEach-Object {
#     if ($_.PSObject.Properties['UninstallString']) { Start-Process cmd -ArgumentList "/c $($_.UninstallString) /S" -Wait }
# }