Detect Microsoft Office PowerPoint Code Injection (CVE-2009-0556) in CrowdStrike LogScale
Detects exploitation attempts of CVE-2009-0556, a code injection vulnerability in Microsoft Office PowerPoint. Attackers can exploit this vulnerability via crafted PowerPoint files to execute arbitrary code in the context of the logged-in user. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Initial Access Execution
LogScale Detection Query
event_simpleName=ProcessRollup2
| search ParentBaseFileName="POWERPNT.EXE"
AND FileName IN ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| eval suspicionReason=case(
match(CommandLine, "(?i)(-enc|-encodedcommand|iex|invoke-expression)"), "Encoded/obfuscated command",
match(CommandLine, "(?i)(http|ftp|\\\\\\\\)"), "Network or UNC path reference",
1=1, "Shell spawned from PowerPoint"
)
| stats count by ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, suspicionReason
| sort -countDetects PowerPoint spawning shell or scripting interpreters via CrowdStrike Falcon telemetry, consistent with CVE-2009-0556 code injection exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macro-based PowerPoint presentations that invoke system tools
- Enterprise automation using Office COM automation from PowerPoint
- Red team or security simulation exercises
Other platforms for CVE-2009-0556
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerPoint Spawning cmd.exe (Simulated CVE-2009-0556 Payload Execution)
Expected signal: Process creation event: parent=POWERPNT.EXE, child=cmd.exe with arguments '/c whoami'
- Test 2PowerPoint Spawning PowerShell with Encoded Command
Expected signal: Sysmon Event ID 1: Image=powershell.exe, ParentImage=powerpnt.exe, CommandLine contains -EncodedCommand
- Test 3Crafted PPT File Drop to Temp Directory
Expected signal: File creation event: FileName=exploit_test.ppt, FolderPath contains \Temp\
Response Playbook
Triage
- Identify the source PowerPoint file: retrieve the file path, hash (MD5/SHA256), and confirm whether it originated from email, web download, USB, or network share.
- Determine if the child process (cmd, powershell, etc.) executed any payloads: review command-line arguments for encoded commands, network callbacks, or file drops.
- Check whether the affected user account has admin rights or access to sensitive systems; prioritize containment if so.
- Correlate with email gateway logs to identify if the file was delivered via phishing (CVE-2009-0556 is KEV — assume active exploitation context).
Containment
- Isolate the affected endpoint from the network immediately using EDR network containment or VLAN isolation to prevent lateral movement or C2 callbacks.
- Revoke any tokens or credentials accessed by the affected user session and force password reset if privilege escalation or credential access is suspected.
Evidence Collection
- Collect memory dump of the powerpnt.exe process (and any child processes) for forensic analysis of injected shellcode or in-memory payloads.
- Preserve the crafted PowerPoint file to a secure quarantine location and calculate SHA256; submit to a malware sandbox for dynamic analysis.
Escalation Criteria
- !Escalate to Incident Response if child processes made outbound network connections, dropped additional executables, or modified registry run keys.
- !Escalate immediately if multiple hosts are affected, indicating a phishing campaign or worm-like lateral spread leveraging the vulnerability.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Crafted PowerPoint file in %TEMP%, %APPDATA%, or Downloads folder with anomalous embedded OLE objects or streams - >
Windows Event ID 4688 or Sysmon Event ID 1 showing POWERPNT.EXE as parent of cmd.exe, powershell.exe, or scripting hosts - >
Prefetch files for wscript.exe, cscript.exe, or mshta.exe with timestamps correlating to PowerPoint launch time
Tuning Guidance
Start by allowlisting known legitimate PowerPoint macro workflows in your environment. Enrich alerts with file reputation from threat intel feeds before escalating. If PowerPoint macros are disabled by Group Policy, increase confidence to high. Consider correlating with email gateway logs to identify phishing campaigns delivering the crafted .ppt file.
Hunting Queries
Hunt for any PowerPoint-spawned interpreter or LOLBin process across the fleet over the past 7 days to identify previously undetected exploitation attempts.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ 'powerpnt.exe'
| where FileName in~ ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'certutil.exe', 'bitsadmin.exe')
| summarize count() by DeviceName, FileName, InitiatingProcessCommandLine, bin(Timestamp, 1h)
| order by count_ descindex=windows source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where like(ParentImage, "%powerpnt.exe%")
| where like(Image, "%cmd.exe%") OR like(Image, "%powershell.exe%") OR like(Image, "%wscript.exe%") OR like(Image, "%mshta.exe%")
| stats earliest(_time) as firstSeen, latest(_time) as lastSeen, count by host, Image, ParentImage, CommandLine
| sort -countAtomic Red Team Tests
Simulates the post-exploitation behavior of CVE-2009-0556 by launching cmd.exe from within a PowerPoint macro. Used to validate detection rules in a lab environment.
Command
powershell -Command "$app = New-Object -ComObject PowerPoint.Application; $pres = $app.Presentations.Add(); $slide = $pres.Slides.Add(1, 1); $macro = $pres.VBProject.VBComponents.Add(1); $macro.CodeModule.AddFromString('Sub Auto_Open() Shell ""cmd.exe /c whoami > C:\\Temp\\cve_2009_0556_test.txt"" End Sub'); $pres.SaveAs('C:\\Temp\\test_cve_2009_0556.ppt', 1); $app.Quit()"Cleanup
Remove-Item C:\Temp\cve_2009_0556_test.txt -ErrorAction SilentlyContinue; Remove-Item C:\Temp\test_cve_2009_0556.ppt -ErrorAction SilentlyContinueExpected Telemetry
Process creation event: parent=POWERPNT.EXE, child=cmd.exe with arguments '/c whoami'
Expected Detection
Alert triggered on PowerPoint spawning cmd.exe with output file written to C:\Temp
Simulates an attacker using a PowerPoint macro to execute an encoded PowerShell payload, mimicking obfuscated shellcode delivery via CVE-2009-0556.
Command
powershell -Command "$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Write-Output CVE-2009-0556-PoC')); Start-Process powerpnt.exe -ArgumentList '/automation'; Start-Sleep 2; Start-Process powershell.exe -ArgumentList "-EncodedCommand $encoded" -Wait"Cleanup
Stop-Process -Name powerpnt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Image=powershell.exe, ParentImage=powerpnt.exe, CommandLine contains -EncodedCommand
Expected Detection
Alert triggered on encoded PowerShell command spawned from PowerPoint process
Simulates the file-drop stage of CVE-2009-0556 exploitation where a crafted PowerPoint file lands in a user's temp directory, as would occur via email attachment or web download.
Command
powershell -Command "$content = [System.Text.Encoding]::UTF8.GetBytes('CVE-2009-0556 test file - not a real exploit'); $path = "$env:TEMP\\exploit_test.ppt"; [IO.File]::WriteAllBytes($path, $content); Write-Output \"File written to $path\"; Get-Item $path | Select Name, Length, LastWriteTime"Cleanup
Remove-Item "$env:TEMP\exploit_test.ppt" -ErrorAction SilentlyContinueExpected Telemetry
File creation event: FileName=exploit_test.ppt, FolderPath contains \Temp\
Expected Detection
Alert or hunting query surfaces .ppt file creation in %TEMP% directory, flagged for review