Microsoft DirectX NULL Byte Overwrite Vulnerability (CVE-2009-1537)

union DeviceProcessEvents, DeviceFileEvents
| where TimeGenerated > ago(7d)
| where (
    (ActionType == "ProcessCreated" and InitiatingProcessFileName =~ "quartz.dll") or
    (FileName =~ "quartz.dll" and ActionType in ("FileModified", "FileCreated")) or
    (InitiatingProcessCommandLine has_any (".mov", ".qt", ".mqv") and ProcessCommandLine has_any ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe"))
)
| extend RiskIndicator = case(
    InitiatingProcessCommandLine has_any (".mov", ".qt", ".mqv"), "QuickTime media file triggered shell process",
    FileName =~ "quartz.dll" and ActionType == "FileModified", "DirectX quartz.dll modified",
    "DirectX related activity"
)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RiskIndicator
| sort by TimeGenerated desc

index=windows (sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
| eval event_type=coalesce(EventCode, event_id)
| where event_type IN ("1", "4688", "11", "4663")
| eval parent_process=coalesce(ParentImage, Creator_Process_Name),
       child_process=coalesce(Image, New_Process_Name),
       cmdline=coalesce(CommandLine, Process_Command_Line),
       target_file=coalesce(TargetFilename, Object_Name)
| where (match(parent_process, "(?i)(wmplayer|mplayer2|iexplore|msmsgs|moviemk)") AND match(cmdline, "(?i)\.(mov|qt|mqv)"))
   OR (match(target_file, "(?i)quartz\.dll") AND event_type IN ("11", "4663"))
   OR (match(parent_process, "(?i)quartz\.dll") AND match(child_process, "(?i)(cmd|powershell|wscript|cscript|mshta)"))
| eval risk_indicator=case(
    match(parent_process, "(?i)(wmplayer|mplayer2)") AND match(cmdline, "(?i)\.(mov|qt|mqv)"), "Media player processing QuickTime file",
    match(target_file, "(?i)quartz\.dll"), "quartz.dll file event",
    1==1, "DirectX/QuickTime suspicious activity"
  )
| table _time, host, user, parent_process, child_process, cmdline, target_file, risk_indicator
| sort - _time

sequence by host.name with maxspan=2m
  [file where file.name like~ "quartz.dll" and event.action in ("creation", "overwrite", "modification")]
  [process where event.action == "start"
    and process.name like~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe")
    and process.parent.name like~ ("wmplayer.exe", "mplayer2.exe", "iexplore.exe", "moviemk.exe")]
| head 100

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationip, username,
       "processname" AS process_name,
       "parentprocessname" AS parent_process,
       QIDNAME(qid) AS event_name,
       "filename" AS file_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (LOWER("filename") LIKE '%quartz.dll%' AND categoryname IN ('File Created', 'File Modified', 'Object Access'))
    OR (
      LOWER("parentprocessname") LIKE '%wmplayer%'
      AND LOWER("processname") IN ('%cmd.exe%', '%powershell.exe%', '%wscript.exe%', '%cscript.exe%')
    )
    OR (LOWER("commandline") LIKE '%.mov%' OR LOWER("commandline") LIKE '%.qt%' OR LOWER("commandline") LIKE '%.mqv%')
  )
  AND starttime > NOW() - 7 DAYS
ORDER BY starttime DESC
LAST 10000

_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| where EventID in ("1", "11", "4688", "4663")
| parse field=Message "Image: *\n" as image nodrop
| parse field=Message "ParentImage: *\n" as parent_image nodrop
| parse field=Message "CommandLine: *\n" as cmdline nodrop
| parse field=Message "TargetFilename: *\n" as target_file nodrop
| where (toLowerCase(target_file) contains "quartz.dll")
    OR (toLowerCase(parent_image) matches "*wmplayer*" AND toLowerCase(image) matches "*(cmd|powershell|wscript|cscript)*")
    OR (toLowerCase(cmdline) matches "*.(mov|qt|mqv)*" AND toLowerCase(image) matches "*(cmd|powershell)*")
| withtime _messageTime
| fields _messageTime, _sourceHost, image, parent_image, cmdline, target_file
| sort by _messageTime desc

rule cve_2009_1537_directx_null_overwrite {
  meta:
    author = "df00tech"
    description = "Detects potential exploitation of CVE-2009-1537 Microsoft DirectX NULL byte overwrite via QuickTime media files"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-028"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.process.file.full_path, `(?i)(wmplayer|mplayer2|iexplore|moviemk)\.exe`)
      and re.regex($e.target.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta)\.exe`)
    )
    or
    (
      $e.metadata.event_type = "FILE_MODIFICATION"
      and re.regex($e.target.file.full_path, `(?i)quartz\.dll`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.target.process.command_line, `(?i)\.(mov|qt|mqv)`)
      and re.regex($e.target.process.file.full_path, `(?i)(cmd|powershell)\.exe`)
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| filter (ImageFileName matches "(?i)(wmplayer|mplayer2|iexplore|moviemk)\.exe" AND CommandLine matches "(?i)\.(mov|qt|mqv)")
   OR (ParentBaseFileName matches "(?i)(wmplayer|mplayer2)\.exe" AND ImageFileName matches "(?i)(cmd|powershell|wscript|cscript|mshta)\.exe")
| eval risk="CVE-2009-1537 DirectX QuickTime exploitation indicator"
| table timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, risk
| sort timestamp desc
| limit 200