Detect Microsoft Windows Video ActiveX Control Remote Code Execution (CVE-2008-0015) in CrowdStrike LogScale
Detects exploitation attempts targeting the Microsoft Windows Video ActiveX Control vulnerability (CVE-2008-0015), addressed in MS09-032. The msvidctl.dll ActiveX control contains a memory corruption flaw that allows remote attackers to execute arbitrary code via a crafted web page. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in drive-by download campaigns.
MITRE ATT&CK
- Tactic
- Initial Access Execution
LogScale Detection Query
event_simpleName=ProcessRollup2
| search ParentBaseFileName="iexplore.exe"
AND (FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe")
OR CommandLine="*0955AC62-BF2E-4CBA-A2B9-A63F772D46CF*")
| table timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine
| sort -timestampCrowdStrike Falcon query detecting Internet Explorer spawning high-risk child processes or command lines containing the vulnerable msvidctl CLSID, indicating CVE-2008-0015 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legacy business workflows where IE invokes scripts as part of normal operation
- Managed security service provider tooling that runs alongside IE for monitoring
- Old intranet portals with legitimate ActiveX-based functionality
Other platforms for CVE-2008-0015
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Verify msvidctl ActiveX Kill Bit Absence
Expected signal: Registry query event (Sysmon EventID 13 or equivalent) accessing the ActiveX Compatibility key for the msvidctl CLSID.
- Test 2Simulate IE Spawning cmd.exe (Post-Exploitation Child Process)
Expected signal: Sysmon EventID 1 showing cmd.exe spawned in close temporal proximity to an iexplore.exe process; may also generate network events if IE loads a page.
- Test 3Reference msvidctl CLSID in Command Line
Expected signal: Sysmon EventID 1 with CommandLine containing the CLSID string {0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}.
- Test 4Attempt to Remove msvidctl Kill Bit (Attacker Persistence Simulation)
Expected signal: Sysmon EventID 12 (registry key deleted) or EventID 14 targeting the ActiveX Compatibility key for the msvidctl CLSID.
Response Playbook
Triage
- Identify the affected host and confirm the version of msvidctl.dll — patch MS09-032 sets the kill bit for CLSID {0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}; check if the host is unpatched.
- Review the browser process tree: determine what URL or file triggered IE and what child processes were created, including any network connections made by child processes.
- Check for signs of successful code execution: new scheduled tasks, registry run keys, dropped executables in %TEMP% or %APPDATA%, and outbound C2 connections from the spawned process.
- Query EDR telemetry for file writes and network activity within 5 minutes of the IE process launch to identify payload delivery or lateral movement.
Containment
- Isolate the affected host from the network immediately if active exploitation or payload execution is confirmed, to prevent lateral movement or C2 beaconing.
- Apply MS09-032 or set the ActiveX kill bit for CLSID {0955AC62-BF2E-4CBA-A2B9-A63F772D46CF} via Group Policy on all unpatched Windows endpoints to prevent further exploitation.
Evidence Collection
- Capture a full memory dump of the iexplore.exe process and any spawned child processes for forensic analysis of injected shellcode or in-memory payloads.
- Collect browser cache, history, and temporary internet files from the affected user profile to identify the malicious URL or file that delivered the exploit.
Escalation Criteria
- !Escalate immediately if the child process spawned by IE established outbound network connections, indicating successful payload download or C2 communication.
- !Escalate if lateral movement indicators are found — e.g., credential dumping tools (mimikatz), pass-the-hash activity, or SMB connections to internal hosts originating from the compromised endpoint.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
msvidctl.dll version in %SystemRoot%\System32 — patched version will have the ActiveX kill bit set in the registry at HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF} - >
Internet Explorer crash dumps in %LOCALAPPDATA%\CrashDumps or Watson reports if the exploit caused an IE crash before achieving reliable execution - >
Prefetch files for any processes spawned by iexplore.exe in the exploitation window (%SystemRoot%\Prefetch\)
Tuning Guidance
This detection is most reliable on Windows XP and Windows Vista endpoints running Internet Explorer 6 or 7, which are the primary affected platforms. False positives are extremely rare on modern patched systems. If firing on patched systems, verify that the msvidctl.dll kill bit is properly set and investigate whether an attacker may have removed it. Consider scoping the detection to legacy OS versions (Windows XP, Vista, Server 2003) if modern endpoints generate noise. The CLSID reference in command-line arguments is a near-zero false-positive indicator and confidence can be tuned to high for that branch.
Hunting Queries
Hunt for registry key creation or modification related to the msvidctl CLSID kill bit, which may indicate either patching activity or an attacker attempting to re-enable the control by removing the kill bit.
DeviceRegistryEvents
| where TimeGenerated > ago(30d)
| where RegistryKey has "ActiveX Compatibility" and RegistryKey has "0955AC62-BF2E-4CBA-A2B9-A63F772D46CF"
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData
| order by TimeGenerated descindex=windows source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
| search TargetObject="*ActiveX Compatibility*0955AC62-BF2E-4CBA-A2B9-A63F772D46CF*"
| table _time, host, user, TargetObject, DetailsAtomic Red Team Tests
Checks whether the ActiveX kill bit for the vulnerable msvidctl CLSID is absent, confirming the host is vulnerable to CVE-2008-0015 exploitation.
Command
reg query "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}" /v "Compatibility Flags" 2>nul && echo Kill bit present - PATCHED || echo Kill bit absent - VULNERABLECleanup
No changes made — read-only registry query.Expected Telemetry
Registry query event (Sysmon EventID 13 or equivalent) accessing the ActiveX Compatibility key for the msvidctl CLSID.
Expected Detection
Absence of the kill bit (return code non-zero) confirms vulnerability; presence with value 0x400 confirms the patch is applied.
Simulates the post-exploitation behavior of CVE-2008-0015 by launching cmd.exe as a child of iexplore.exe using WMI process creation, mimicking shellcode execution behavior.
Command
powershell -Command "$ie = New-Object -ComObject InternetExplorer.Application; Start-Process cmd.exe; $ie.Quit()"Cleanup
taskkill /F /IM cmd.exe /T 2>nul; taskkill /F /IM iexplore.exe /T 2>nulExpected Telemetry
Sysmon EventID 1 showing cmd.exe spawned in close temporal proximity to an iexplore.exe process; may also generate network events if IE loads a page.
Expected Detection
Detection rule should fire on the IE-to-cmd.exe process relationship, flagging as suspicious child process spawning consistent with CVE-2008-0015 exploitation.
Simulates an attacker or exploit kit referencing the vulnerable ActiveX CLSID in a command-line context, as might occur in a second-stage payload launcher.
Command
cmd.exe /c echo Simulating CLSID reference: {0955AC62-BF2E-4CBA-A2B9-A63F772D46CF} && echo Exploit simulation completeCleanup
No persistent changes — echo command only.Expected Telemetry
Sysmon EventID 1 with CommandLine containing the CLSID string {0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}.
Expected Detection
CLSID-based branch of detection rules should fire on the command-line match, generating a high-confidence alert regardless of parent process.
Simulates an attacker attempting to re-enable the vulnerable ActiveX control by deleting the kill bit registry entry, which would re-expose a previously patched host.
Command
reg delete "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}" /v "Compatibility Flags" /fCleanup
reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}" /v "Compatibility Flags" /t REG_DWORD /d 0x400 /fExpected Telemetry
Sysmon EventID 12 (registry key deleted) or EventID 14 targeting the ActiveX Compatibility key for the msvidctl CLSID.
Expected Detection
Hunting query for kill bit modification should alert; additionally, any subsequent exploit attempt against the re-enabled control would fire the primary detection.