Detect Microsoft DirectX NULL Byte Overwrite Vulnerability (CVE-2009-1537) in Splunk
CVE-2009-1537 is a NULL byte overwrite vulnerability in Microsoft DirectX (quartz.dll) that can be exploited via a maliciously crafted QuickTime media file. Successful exploitation allows remote code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Addressed in MS09-028.
MITRE ATT&CK
- Tactic
- Initial Access Execution
SPL Detection Query
index=windows (sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
| eval event_type=coalesce(EventCode, event_id)
| where event_type IN ("1", "4688", "11", "4663")
| eval parent_process=coalesce(ParentImage, Creator_Process_Name),
child_process=coalesce(Image, New_Process_Name),
cmdline=coalesce(CommandLine, Process_Command_Line),
target_file=coalesce(TargetFilename, Object_Name)
| where (match(parent_process, "(?i)(wmplayer|mplayer2|iexplore|msmsgs|moviemk)") AND match(cmdline, "(?i)\.(mov|qt|mqv)"))
OR (match(target_file, "(?i)quartz\.dll") AND event_type IN ("11", "4663"))
OR (match(parent_process, "(?i)quartz\.dll") AND match(child_process, "(?i)(cmd|powershell|wscript|cscript|mshta)"))
| eval risk_indicator=case(
match(parent_process, "(?i)(wmplayer|mplayer2)") AND match(cmdline, "(?i)\.(mov|qt|mqv)"), "Media player processing QuickTime file",
match(target_file, "(?i)quartz\.dll"), "quartz.dll file event",
1==1, "DirectX/QuickTime suspicious activity"
)
| table _time, host, user, parent_process, child_process, cmdline, target_file, risk_indicator
| sort - _timeDetects suspicious activity related to CVE-2009-1537 on Windows hosts by correlating Sysmon and Security event logs for QuickTime media file processing by media players, unexpected quartz.dll file events, and shell processes spawned in DirectX media contexts.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate Windows Update or DirectX redistribution patching quartz.dll
- Media production workflows that open QuickTime files in Windows Media Player
- Security tools performing file integrity monitoring on system DLLs
- Software compatibility shims invoking shell processes during media playback
Other platforms for CVE-2009-1537
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate QuickTime File Opening via Windows Media Player
Expected signal: Sysmon Event ID 1 showing wmplayer.exe process creation with .mov file argument; DeviceProcessEvents in Defender for Endpoint capturing InitiatingProcessFileName=wmplayer.exe
- Test 2Simulate Shell Process Spawn from Media Player Context
Expected signal: Sysmon Event ID 1 with ParentImage containing wmplayer.exe and Image=cmd.exe; command line output file created in C:\AtomicTests\
- Test 3Simulate quartz.dll File Modification Event
Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename matching quartz.dll pattern; DeviceFileEvents showing FileName=quartz.dll with ActionType=FileCreated
Unlock Pro Content
Get the full detection package for CVE-2009-1537 including response playbook, investigation guide, and atomic red team tests.