CVE-2021-31979 and CVE-2021-33771 Exploits via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•23

Detects registry modifications associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, which were reportedly used by the threat group Sourgum with the DevilsTongue malware. Specifically, it looks for changes to the default values of InprocServer32 for specific CLSIDs, while filtering out legitimate system DLLs.