Microsoft Office PowerPoint Code Injection (CVE-2009-0556)

let suspiciousPptExtensions = dynamic(['.ppt', '.pptx', '.pps', '.ppsx', '.pot', '.potx']);
let lookback = 48h;
union DeviceProcessEvents, DeviceFileEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ 'powerpnt.exe'
    or (ActionType == 'FileCreated' and FileName has_any (suspiciousPptExtensions))
| where InitiatingProcessParentFileName in~ ('winword.exe', 'excel.exe', 'outlook.exe', 'powerpnt.exe')
    or (InitiatingProcessFileName =~ 'powerpnt.exe' and FileName has_any (suspiciousPptExtensions) and FolderPath has_any ('\\Temp\\', '\\AppData\\', '\\Downloads\\'))
| extend suspicionReason = case(
    InitiatingProcessFileName =~ 'powerpnt.exe' and ProcessCommandLine has_any ('cmd.exe', 'powershell', 'wscript', 'cscript', 'mshta'), 'PowerPoint spawning shell',
    FolderPath has_any ('\\Temp\\', '\\AppData\\Local\\Temp\\'), 'Suspicious temp path',
    true(), 'General anomaly'
  )
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, suspicionReason

index=windows (source="WinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="WinEventLog:Security")
| eval parent=lower(ParentImage), proc=lower(Image), cmdline=lower(CommandLine)
| where parent="*powerpnt.exe*"
    AND (proc IN ("*cmd.exe*", "*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*mshta.exe*", "*rundll32.exe*", "*regsvr32.exe*")
         OR cmdline IN ("*temp*", "*appdata*", "*downloads*"))
| eval suspicionScore=case(
    match(proc, "(?i)(powershell|cmd|wscript|cscript|mshta)"), 3,
    match(cmdline, "(?i)(temp|appdata|downloads)"), 2,
    1=1, 1
  )
| where suspicionScore >= 2
| stats count, values(proc) as ChildProcesses, values(cmdline) as CommandLines, earliest(_time) as firstSeen, latest(_time) as lastSeen by host, parent, user
| sort -count

sequence by host.name with maxspan=2m
  [process where event.type == "start" and process.name : "POWERPNT.EXE"]
  [process where event.type == "start"
    and process.parent.name : "POWERPNT.EXE"
    and process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")]
| head 100

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
       sourceip, username, "Process Name", "Parent Process Name", "Command"
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Windows%'
  AND ("Parent Process Name" ILIKE '%powerpnt.exe%'
       AND "Process Name" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%cscript.exe%', '%mshta.exe%', '%rundll32.exe%'))
  AND starttime > NOW() - 48 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| parse "ParentImage=*\\" as parentImage
| parse "Image=*\\" as childImage
| where toLowerCase(parentImage) = "powerpnt.exe"
| where toLowerCase(childImage) in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| parse "CommandLine=*" as commandLine
| count by _sourceHost, parentImage, childImage, commandLine
| order by _count desc

rule cve_2009_0556_powerpnt_code_injection {
  meta:
    author = "df00tech"
    description = "Detects PowerPoint spawning shell interpreters (CVE-2009-0556)"
    severity = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2009-0556"
  events:
    $parent.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($parent.principal.process.file.full_path, `(?i)powerpnt\.exe$`)
    $child.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($child.principal.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32)\.exe$`)
    $parent.principal.hostname = $child.principal.hostname
    $child.target.process.parent_process.pid = $parent.target.process.pid
  condition:
    $parent and $child
}

event_simpleName=ProcessRollup2
| search ParentBaseFileName="POWERPNT.EXE"
    AND FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| eval suspicionReason=case(
    match(CommandLine, "(?i)(-enc|-encodedcommand|iex|invoke-expression)"), "Encoded/obfuscated command",
    match(CommandLine, "(?i)(http|ftp|\\\\\\\\)"), "Network or UNC path reference",
    1=1, "Shell spawned from PowerPoint"
  )
| stats count by ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, suspicionReason
| sort -count