Microsoft Windows Video ActiveX Control Remote Code Execution (CVE-2008-0015)

union DeviceProcessEvents, DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("iexplore.exe", "mshtml.dll")
    or ProcessCommandLine has_any ("msvidctl", "CLSID", "{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}")
| extend suspiciousChild = iff(
    InitiatingProcessFileName in~ ("iexplore.exe") and FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe"),
    true, false
  )
| where suspiciousChild == true
    or ProcessCommandLine has "{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}"
| project TimeGenerated, DeviceId, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, RemoteIP, RemotePort
| order by TimeGenerated desc

index=windows (source="WinEventLog:Security" OR source="WinEventLog:Microsoft-Windows-Sysmon/Operational")
| eval isSuspiciousParent=if(match(ParentImage, "(?i)iexplore\.exe"), 1, 0)
| eval isSuspiciousChild=if(match(Image, "(?i)(cmd|powershell|wscript|cscript|rundll32|regsvr32)\.exe"), 1, 0)
| eval referencesClsid=if(match(CommandLine, "(?i)(0955AC62-BF2E-4CBA-A2B9-A63F772D46CF|msvidctl)"), 1, 0)
| where (isSuspiciousParent=1 AND isSuspiciousChild=1) OR referencesClsid=1
| table _time, host, user, ParentImage, Image, CommandLine
| sort -_time

sequence by host.name with maxspan=30s
  [process where process.name : "iexplore.exe" and event.type == "start"]
  [process where process.parent.name : "iexplore.exe"
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe")]

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS EventTime, sourceip, username, "Process Name", "Parent Process Name", "Command"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND ("Parent Process Name" ILIKE '%iexplore.exe%'
       AND ("Process Name" ILIKE '%cmd.exe%'
            OR "Process Name" ILIKE '%powershell.exe%'
            OR "Process Name" ILIKE '%wscript.exe%'
            OR "Process Name" ILIKE '%rundll32.exe%'
            OR "Process Name" ILIKE '%regsvr32.exe%'))
   OR "Command" ILIKE '%0955AC62-BF2E-4CBA-A2B9-A63F772D46CF%'
LAST 7 DAYS
ORDER BY devicetime DESC

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| parse regex "ParentImage=(?<ParentImage>[^\s]+)" nodrop
| parse regex "Image=(?<Image>[^\s]+)" nodrop
| parse regex "CommandLine=(?<CommandLine>.+)" nodrop
| where (ParentImage matches "*iexplore.exe*"
         and (Image matches "*cmd.exe*" or Image matches "*powershell.exe*"
              or Image matches "*wscript.exe*" or Image matches "*rundll32.exe*"))
      or CommandLine matches "*0955AC62-BF2E-4CBA-A2B9-A63F772D46CF*"
| count by _sourceHost, ParentImage, Image, CommandLine
| sort by _count desc

rule cve_2008_0015_msvidctl_activex_rce {
  meta:
    author = "df00tech"
    description = "Detects CVE-2008-0015 exploitation via IE spawning suspicious child processes or msvidctl CLSID references"
    severity = "CRITICAL"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2008-0015"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.process.file.full_path, `(?i)iexplore\.exe`)
      and re.regex($e.target.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|rundll32|regsvr32)\.exe`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.target.process.command_line, `(?i)0955AC62-BF2E-4CBA-A2B9-A63F772D46CF`)
    )

  condition:
    $e
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName="iexplore.exe"
    AND (FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe")
         OR CommandLine="*0955AC62-BF2E-4CBA-A2B9-A63F772D46CF*")
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine
| sort -timestamp