CVE-2021-31979 & CVE-2021-33771 Exploitation by Sourgum

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•21

Detects the creation or modification of specific files associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, and the deployment of DevilsTongue malware by the threat group Sourgum. The rule specifically looks for the presence of certain filenames in critical system directories.