CVE-2009-1537 CrowdStrike LogScale · LogScale

Detect Microsoft DirectX NULL Byte Overwrite Vulnerability (CVE-2009-1537) in CrowdStrike LogScale

CVE-2009-1537 is a NULL byte overwrite vulnerability in Microsoft DirectX (quartz.dll) that can be exploited via a maliciously crafted QuickTime media file. Successful exploitation allows remote code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Addressed in MS09-028.

MITRE ATT&CK

Tactic
Initial Access Execution

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| filter (ImageFileName matches "(?i)(wmplayer|mplayer2|iexplore|moviemk)\.exe" AND CommandLine matches "(?i)\.(mov|qt|mqv)")
   OR (ParentBaseFileName matches "(?i)(wmplayer|mplayer2)\.exe" AND ImageFileName matches "(?i)(cmd|powershell|wscript|cscript|mshta)\.exe")
| eval risk="CVE-2009-1537 DirectX QuickTime exploitation indicator"
| table timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, risk
| sort timestamp desc
| limit 200
critical severity medium confidence

CrowdStrike Falcon NG-SIEM query detecting process chains consistent with CVE-2009-1537 exploitation: media players processing QuickTime files and spawning shell interpreters.

Data Sources

CrowdStrike Falcon EDRCrowdStrike Process Events

Required Tables

ProcessRollup2

False Positives & Tuning

  • Legitimate software update processes launched from media application context
  • Enterprise deployment tools that use media player executables as launchers
  • Software compatibility layers processing legacy QuickTime media
  • Automated media transcoding pipelines invoking shell commands

Other platforms for CVE-2009-1537

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate QuickTime File Opening via Windows Media Player

    Expected signal: Sysmon Event ID 1 showing wmplayer.exe process creation with .mov file argument; DeviceProcessEvents in Defender for Endpoint capturing InitiatingProcessFileName=wmplayer.exe

  2. Test 2Simulate Shell Process Spawn from Media Player Context

    Expected signal: Sysmon Event ID 1 with ParentImage containing wmplayer.exe and Image=cmd.exe; command line output file created in C:\AtomicTests\

  3. Test 3Simulate quartz.dll File Modification Event

    Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename matching quartz.dll pattern; DeviceFileEvents showing FileName=quartz.dll with ActionType=FileCreated

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm the affected host has not applied MS09-028 by checking the patch level: query WSUS/SCCM or run 'wmic qfe list' and look for KB971633 / KB971634 / KB971961.
  2. Identify the media file that triggered the alert — capture the full path, hash (SHA-256), and originating download source (browser history, email attachment, network share).
  3. Determine the user context under which quartz.dll was loaded and whether the triggering process ran with elevated privileges.

Containment

  1. Isolate the affected endpoint from the network immediately via EDR network containment or manual VLAN reassignment to prevent lateral movement or C2 callback.
  2. Block inbound QuickTime media file types (.mov, .qt, .mqv) at the email gateway and web proxy to prevent further delivery of exploit payloads across the environment.

Evidence Collection

  1. Collect a memory dump of the affected system (e.g., using WinPmem or CrowdStrike Real Time Response) to capture in-memory artifacts from the NULL byte overwrite exploitation.
  2. Preserve the malicious QuickTime media file in an isolated evidence store — hash and submit to sandbox for dynamic analysis to enumerate second-stage payloads.

Escalation Criteria

  • !Escalate to Incident Response if lateral movement is detected — e.g., SMB enumeration, PsExec usage, or new scheduled tasks created after the initial process anomaly.
  • !Escalate if the spawned process establishes an outbound connection to an external IP, indicating successful code execution and potential C2 communication.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Prefetch files for wmplayer.exe or iexplore.exe indicating recent execution with QuickTime file arguments (%SystemRoot%\Prefetch\)
  • >Windows Event Log entries (Event ID 4688 / Sysmon Event ID 1) showing child process creation from media player parent with unexpected command lines
  • >File system artifacts of the dropped QuickTime payload file in %TEMP%, %APPDATA%, or browser download directories
  • >Registry run keys or scheduled tasks created by any post-exploitation payload dropped after quartz.dll exploitation

Tuning Guidance

This rule generates the most noise in environments with active media production workflows where QuickTime files are processed routinely. Tune by adding allowlists for known media workstation hostnames and verified media pipeline service accounts. Consider scoping the quartz.dll file modification detection to exclude changes made by SYSTEM during Windows Update hours (typically 03:00–05:00 local). For the process chain detections, add a join against network connection events (DeviceNetworkEvents) to elevate confidence — a shell process that immediately establishes an external connection is near-certain exploitation.

Hunting Queries

Threat hunt for historical instances of shell processes spawned from media player parents across the environment over the last 30 days, helping identify hosts that may have been compromised via CVE-2009-1537 prior to detection rule deployment.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("wmplayer.exe", "mplayer2.exe", "iexplore.exe", "moviemk.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
| summarize count(), makeset(ProcessCommandLine) by DeviceName, InitiatingProcessFileName, FileName
| sort by count_ desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| eval parent=lower(ParentImage), child=lower(Image)
| where match(parent, "(wmplayer|mplayer2|iexplore|moviemk)")
  AND match(child, "(cmd|powershell|wscript|cscript|mshta|rundll32)")
| stats count by host, user, ParentImage, Image, CommandLine
| sort - count

Atomic Red Team Tests

Test 1 Simulate QuickTime File Opening via Windows Media Player
windows

Simulate the delivery mechanism by opening a benign .mov file with wmplayer.exe to validate that process creation telemetry is captured for the parent-child chain monitored by this detection.

Command

powershell 
Start-Process -FilePath 'C:\Program Files\Windows Media Player\wmplayer.exe' -ArgumentList 'C:\AtomicTests\test_payload.mov'

Cleanup

powershell 
Stop-Process -Name wmplayer -Force -ErrorAction SilentlyContinue; Remove-Item 'C:\AtomicTests\test_payload.mov' -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing wmplayer.exe process creation with .mov file argument; DeviceProcessEvents in Defender for Endpoint capturing InitiatingProcessFileName=wmplayer.exe

Expected Detection

Should trigger the media player QuickTime file processing indicator in KQL and SPL queries

Test 2 Simulate Shell Process Spawn from Media Player Context
windows

Directly simulate the post-exploitation process chain by launching cmd.exe with wmplayer.exe as the parent process using WMI, mimicking the shell spawn that occurs after successful NULL byte overwrite exploitation.

Command

powershell 
$wmi = [wmiclass]'win32_process'; $startup = [wmiclass]'win32_processstartup'; $startup.Properties['ShowWindow'].Value = 0; $wmi.Create('cmd.exe /c whoami > C:\AtomicTests\cve_2009_1537_test.txt', $null, $startup)

Cleanup

powershell 
Remove-Item 'C:\AtomicTests\cve_2009_1537_test.txt' -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 with ParentImage containing wmplayer.exe and Image=cmd.exe; command line output file created in C:\AtomicTests\

Expected Detection

Should trigger parent-child shell spawn detection across KQL, SPL, and Elastic EQL queries

Test 3 Simulate quartz.dll File Modification Event
windows

Create a benign file named quartz.dll in a temp directory to simulate the file write telemetry that would be generated if an attacker overwrote the legitimate DirectX DLL during exploitation.

Command

powershell 
New-Item -Path 'C:\AtomicTests\quartz.dll' -ItemType File -Force; Set-Content -Path 'C:\AtomicTests\quartz.dll' -Value 'ATOMIC_TEST_CVE_2009_1537'

Cleanup

powershell 
Remove-Item 'C:\AtomicTests\quartz.dll' -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) with TargetFilename matching quartz.dll pattern; DeviceFileEvents showing FileName=quartz.dll with ActionType=FileCreated

Expected Detection

Should trigger the quartz.dll file event detection in KQL, SPL, and EQL queries; Chronicle YARA-L FILE_MODIFICATION event should fire

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1203Exploitation for Client ExecutionT1566.002Spearphishing LinkT1059.001PowerShell

Same Tactic: Initial Access

Popular Detections