Detect Microsoft Office PowerPoint Code Injection (CVE-2009-0556) in Microsoft Sentinel
Detects exploitation attempts of CVE-2009-0556, a code injection vulnerability in Microsoft Office PowerPoint. Attackers can exploit this vulnerability via crafted PowerPoint files to execute arbitrary code in the context of the logged-in user. This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Initial Access Execution
KQL Detection Query
let suspiciousPptExtensions = dynamic(['.ppt', '.pptx', '.pps', '.ppsx', '.pot', '.potx']);
let lookback = 48h;
union DeviceProcessEvents, DeviceFileEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ 'powerpnt.exe'
or (ActionType == 'FileCreated' and FileName has_any (suspiciousPptExtensions))
| where InitiatingProcessParentFileName in~ ('winword.exe', 'excel.exe', 'outlook.exe', 'powerpnt.exe')
or (InitiatingProcessFileName =~ 'powerpnt.exe' and FileName has_any (suspiciousPptExtensions) and FolderPath has_any ('\\Temp\\', '\\AppData\\', '\\Downloads\\'))
| extend suspicionReason = case(
InitiatingProcessFileName =~ 'powerpnt.exe' and ProcessCommandLine has_any ('cmd.exe', 'powershell', 'wscript', 'cscript', 'mshta'), 'PowerPoint spawning shell',
FolderPath has_any ('\\Temp\\', '\\AppData\\Local\\Temp\\'), 'Suspicious temp path',
true(), 'General anomaly'
)
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, suspicionReasonDetects PowerPoint spawning suspicious child processes or creating files in temp paths, consistent with CVE-2009-0556 exploitation via crafted .ppt files.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate macros in PowerPoint files that launch scripts for business automation
- IT deployment tools that use PowerPoint templates with scripting hooks
- Security training or red team exercises running simulated phishing payloads
Other platforms for CVE-2009-0556
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerPoint Spawning cmd.exe (Simulated CVE-2009-0556 Payload Execution)
Expected signal: Process creation event: parent=POWERPNT.EXE, child=cmd.exe with arguments '/c whoami'
- Test 2PowerPoint Spawning PowerShell with Encoded Command
Expected signal: Sysmon Event ID 1: Image=powershell.exe, ParentImage=powerpnt.exe, CommandLine contains -EncodedCommand
- Test 3Crafted PPT File Drop to Temp Directory
Expected signal: File creation event: FileName=exploit_test.ppt, FolderPath contains \Temp\
Unlock Pro Content
Get the full detection package for CVE-2009-0556 including response playbook, investigation guide, and atomic red team tests.