huntrule

Windows file event detection for CVE-2021-31979 and CVE-2021-33771 exploitation artifact paths

Flags Windows file events where the target filename matches paths tied to CVE-2021-31979/CVE-2021-33771 exploitation patterns.

FreeReviewedSigma · Critical · v5
Product
windows
Category
file_event
Author
Sittikorn S (SigmaHQ), DRL 1.1
Published
2021-07-16
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows file creation or access events matching specific target file paths associated with exploitation activity around CVE-2021-31979 and CVE-2021-33771. Attackers may leverage these artifacts to establish or execute malicious components during initial access and follow-on actions. It relies on Windows file event telemetry that includes the full target filename for the matched paths.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange
Windows Registry Modification Indicative of CVE-2021-31979 and CVE-2021-33771 Exploitation
Proxy downloads of executable and document files from suspicious TLDs (blacklisted domains)
Proxy: Block Suspicious Executable Downloads from Non-Trusted Top-Level Domains
Malicious Office 365 Email Rule Breach - On Behalf (via office365)
Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831
Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)
Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit
Suspicious Network Connection From CUPS Foomatic-Rip Child Process
Antivirus signatures matching APT malware naming patterns
Windows file event detection for CVE-2021-31979 and CVE-2021-33771 exploitation artifact paths
Pivot detection · T1203 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.