Microsoft Office Remote Code Execution (CVE-2009-0238)

let suspiciousOfficeProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe"]);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("excel.exe", "winword.exe", "powerpnt.exe")
| where FileName in~ (suspiciousOfficeProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| extend RiskIndicator = case(
    ProcessCommandLine contains "-enc" or ProcessCommandLine contains "-encoded", "Encoded Powershell",
    ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "WebClient", "Network Download",
    ProcessCommandLine contains "IEX" or ProcessCommandLine contains "Invoke-Expression", "In-Memory Execution",
    "Suspicious Child Process"
  )
| order by TimeGenerated desc

index=windows sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
| search (EventCode=4688 OR EventCode=1)
| eval parent=coalesce(ParentProcessName, parent_process_name)
| eval child=coalesce(NewProcessName, process_name)
| where match(lower(parent), "excel\.exe|winword\.exe|powerpnt\.exe")
| where match(lower(child), "cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|certutil\.exe")
| eval command=coalesce(CommandLine, process)
| eval risk=case(
    match(lower(command), "-enc|-encoded"), "Encoded PowerShell",
    match(lower(command), "downloadstring|webclient"), "Network Download",
    match(lower(command), "iex|invoke-expression"), "In-Memory Execution",
    true(), "Suspicious Child Process"
  )
| table _time, host, user, parent, child, command, risk
| sort -_time

process where event.type == "start"
  and process.parent.name in~ ("excel.exe", "winword.exe", "powerpnt.exe")
  and process.name in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe")

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as EventTime, sourceip, username, "Process Name" as ChildProcess, "Parent Process Name" as ParentProcess, "Command" as CommandLine
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%Windows%'
AND LOWER("Parent Process Name") IN ('excel.exe', 'winword.exe', 'powerpnt.exe')
AND LOWER("Process Name") IN ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'certutil.exe')
LAST 7 DAYS
ORDER BY EventTime DESC

_sourceCategory=windows/events
| where EventID in ("4688", "1")
| parse field=Message "New Process Name:\t*" as NewProcessName nodrop
| parse field=Message "Creator Process Name:\t*" as ParentProcessName nodrop
| parse field=Message "Process Name: *" as ProcessName nodrop
| parse field=Message "ParentImage: *" as ParentImage nodrop
| eval parent = if(!isNull(ParentProcessName), ParentProcessName, ParentImage)
| eval child = if(!isNull(NewProcessName), NewProcessName, ProcessName)
| where matches(toLowerCase(parent), "excel\.exe|winword\.exe|powerpnt\.exe")
| where matches(toLowerCase(child), "cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe")
| fields _messagetime, _sourceHost, parent, child
| sort by _messagetime desc

rule cve_2009_0238_office_rce {
  meta:
    author = "df00tech"
    description = "Detects Microsoft Office spawning suspicious child processes consistent with CVE-2009-0238 exploitation"
    severity = "CRITICAL"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2009-0238"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /(?i)(excel|winword|powerpnt)\.exe$/
    $e.target.process.file.full_path = /(?i)(cmd|powershell|wscript|cscript|mshta|regsvr32|rundll32|certutil)\.exe$/

  condition:
    $e
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName IN ("excel.exe", "winword.exe", "powerpnt.exe")
  AND FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe")
| eval RiskTier=case(
    match(lower(CommandLine), "-enc|-encoded"), "EncodedPowerShell",
    match(lower(CommandLine), "downloadstring|iwr|webclient"), "NetworkDownload",
    match(lower(CommandLine), "iex|invoke-expression"), "InMemoryExec",
    true(), "SuspiciousChild"
  )
| table _time, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, RiskTier
| sort -_time