Detect Microsoft Windows Video ActiveX Control Remote Code Execution (CVE-2008-0015) in Google Chronicle
Detects exploitation attempts targeting the Microsoft Windows Video ActiveX Control vulnerability (CVE-2008-0015), addressed in MS09-032. The msvidctl.dll ActiveX control contains a memory corruption flaw that allows remote attackers to execute arbitrary code via a crafted web page. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in drive-by download campaigns.
MITRE ATT&CK
- Tactic
- Initial Access Execution
YARA-L Detection Query
rule cve_2008_0015_msvidctl_activex_rce {
meta:
author = "df00tech"
description = "Detects CVE-2008-0015 exploitation via IE spawning suspicious child processes or msvidctl CLSID references"
severity = "CRITICAL"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2008-0015"
events:
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e.principal.process.file.full_path, `(?i)iexplore\.exe`)
and re.regex($e.target.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|rundll32|regsvr32)\.exe`)
)
or
(
$e.metadata.event_type = "PROCESS_LAUNCH"
and re.regex($e.target.process.command_line, `(?i)0955AC62-BF2E-4CBA-A2B9-A63F772D46CF`)
)
condition:
$e
}Chronicle YARA-L rule detecting IE-to-suspicious-child process launch chains or direct CLSID invocations linked to CVE-2008-0015.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate media playback software bundled with Internet Explorer integration
- Enterprise automation frameworks using IE as a scripting host
- Security tooling that validates ActiveX control registration during audits
Other platforms for CVE-2008-0015
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Verify msvidctl ActiveX Kill Bit Absence
Expected signal: Registry query event (Sysmon EventID 13 or equivalent) accessing the ActiveX Compatibility key for the msvidctl CLSID.
- Test 2Simulate IE Spawning cmd.exe (Post-Exploitation Child Process)
Expected signal: Sysmon EventID 1 showing cmd.exe spawned in close temporal proximity to an iexplore.exe process; may also generate network events if IE loads a page.
- Test 3Reference msvidctl CLSID in Command Line
Expected signal: Sysmon EventID 1 with CommandLine containing the CLSID string {0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}.
- Test 4Attempt to Remove msvidctl Kill Bit (Attacker Persistence Simulation)
Expected signal: Sysmon EventID 12 (registry key deleted) or EventID 14 targeting the ActiveX Compatibility key for the msvidctl CLSID.
Unlock Pro Content
Get the full detection package for CVE-2008-0015 including response playbook, investigation guide, and atomic red team tests.