CVE-2009-1537 Splunk · SPL

Detect Microsoft DirectX NULL Byte Overwrite Vulnerability (CVE-2009-1537) in Splunk

CVE-2009-1537 is a NULL byte overwrite vulnerability in Microsoft DirectX (quartz.dll) that can be exploited via a maliciously crafted QuickTime media file. Successful exploitation allows remote code execution in the context of the logged-on user. This vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Addressed in MS09-028.

MITRE ATT&CK

Tactic
Initial Access Execution

SPL Detection Query

Splunk (SPL)
spl 
index=windows (sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
| eval event_type=coalesce(EventCode, event_id)
| where event_type IN ("1", "4688", "11", "4663")
| eval parent_process=coalesce(ParentImage, Creator_Process_Name),
       child_process=coalesce(Image, New_Process_Name),
       cmdline=coalesce(CommandLine, Process_Command_Line),
       target_file=coalesce(TargetFilename, Object_Name)
| where (match(parent_process, "(?i)(wmplayer|mplayer2|iexplore|msmsgs|moviemk)") AND match(cmdline, "(?i)\.(mov|qt|mqv)"))
   OR (match(target_file, "(?i)quartz\.dll") AND event_type IN ("11", "4663"))
   OR (match(parent_process, "(?i)quartz\.dll") AND match(child_process, "(?i)(cmd|powershell|wscript|cscript|mshta)"))
| eval risk_indicator=case(
    match(parent_process, "(?i)(wmplayer|mplayer2)") AND match(cmdline, "(?i)\.(mov|qt|mqv)"), "Media player processing QuickTime file",
    match(target_file, "(?i)quartz\.dll"), "quartz.dll file event",
    1==1, "DirectX/QuickTime suspicious activity"
  )
| table _time, host, user, parent_process, child_process, cmdline, target_file, risk_indicator
| sort - _time
critical severity medium confidence

Detects suspicious activity related to CVE-2009-1537 on Windows hosts by correlating Sysmon and Security event logs for QuickTime media file processing by media players, unexpected quartz.dll file events, and shell processes spawned in DirectX media contexts.

Data Sources

Windows Event LogsSysmon

Required Sourcetypes

WinEventLog:SecurityXmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Legitimate Windows Update or DirectX redistribution patching quartz.dll
  • Media production workflows that open QuickTime files in Windows Media Player
  • Security tools performing file integrity monitoring on system DLLs
  • Software compatibility shims invoking shell processes during media playback

Other platforms for CVE-2009-1537

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate QuickTime File Opening via Windows Media Player

    Expected signal: Sysmon Event ID 1 showing wmplayer.exe process creation with .mov file argument; DeviceProcessEvents in Defender for Endpoint capturing InitiatingProcessFileName=wmplayer.exe

  2. Test 2Simulate Shell Process Spawn from Media Player Context

    Expected signal: Sysmon Event ID 1 with ParentImage containing wmplayer.exe and Image=cmd.exe; command line output file created in C:\AtomicTests\

  3. Test 3Simulate quartz.dll File Modification Event

    Expected signal: Sysmon Event ID 11 (FileCreate) with TargetFilename matching quartz.dll pattern; DeviceFileEvents showing FileName=quartz.dll with ActionType=FileCreated

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm the affected host has not applied MS09-028 by checking the patch level: query WSUS/SCCM or run 'wmic qfe list' and look for KB971633 / KB971634 / KB971961.
  2. Identify the media file that triggered the alert — capture the full path, hash (SHA-256), and originating download source (browser history, email attachment, network share).
  3. Determine the user context under which quartz.dll was loaded and whether the triggering process ran with elevated privileges.

Containment

  1. Isolate the affected endpoint from the network immediately via EDR network containment or manual VLAN reassignment to prevent lateral movement or C2 callback.
  2. Block inbound QuickTime media file types (.mov, .qt, .mqv) at the email gateway and web proxy to prevent further delivery of exploit payloads across the environment.

Evidence Collection

  1. Collect a memory dump of the affected system (e.g., using WinPmem or CrowdStrike Real Time Response) to capture in-memory artifacts from the NULL byte overwrite exploitation.
  2. Preserve the malicious QuickTime media file in an isolated evidence store — hash and submit to sandbox for dynamic analysis to enumerate second-stage payloads.

Escalation Criteria

  • !Escalate to Incident Response if lateral movement is detected — e.g., SMB enumeration, PsExec usage, or new scheduled tasks created after the initial process anomaly.
  • !Escalate if the spawned process establishes an outbound connection to an external IP, indicating successful code execution and potential C2 communication.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Prefetch files for wmplayer.exe or iexplore.exe indicating recent execution with QuickTime file arguments (%SystemRoot%\Prefetch\)
  • >Windows Event Log entries (Event ID 4688 / Sysmon Event ID 1) showing child process creation from media player parent with unexpected command lines
  • >File system artifacts of the dropped QuickTime payload file in %TEMP%, %APPDATA%, or browser download directories
  • >Registry run keys or scheduled tasks created by any post-exploitation payload dropped after quartz.dll exploitation

Tuning Guidance

This rule generates the most noise in environments with active media production workflows where QuickTime files are processed routinely. Tune by adding allowlists for known media workstation hostnames and verified media pipeline service accounts. Consider scoping the quartz.dll file modification detection to exclude changes made by SYSTEM during Windows Update hours (typically 03:00–05:00 local). For the process chain detections, add a join against network connection events (DeviceNetworkEvents) to elevate confidence — a shell process that immediately establishes an external connection is near-certain exploitation.

Hunting Queries

Threat hunt for historical instances of shell processes spawned from media player parents across the environment over the last 30 days, helping identify hosts that may have been compromised via CVE-2009-1537 prior to detection rule deployment.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("wmplayer.exe", "mplayer2.exe", "iexplore.exe", "moviemk.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
| summarize count(), makeset(ProcessCommandLine) by DeviceName, InitiatingProcessFileName, FileName
| sort by count_ desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
| eval parent=lower(ParentImage), child=lower(Image)
| where match(parent, "(wmplayer|mplayer2|iexplore|moviemk)")
  AND match(child, "(cmd|powershell|wscript|cscript|mshta|rundll32)")
| stats count by host, user, ParentImage, Image, CommandLine
| sort - count

Atomic Red Team Tests

Test 1 Simulate QuickTime File Opening via Windows Media Player
windows

Simulate the delivery mechanism by opening a benign .mov file with wmplayer.exe to validate that process creation telemetry is captured for the parent-child chain monitored by this detection.

Command

powershell 
Start-Process -FilePath 'C:\Program Files\Windows Media Player\wmplayer.exe' -ArgumentList 'C:\AtomicTests\test_payload.mov'

Cleanup

powershell 
Stop-Process -Name wmplayer -Force -ErrorAction SilentlyContinue; Remove-Item 'C:\AtomicTests\test_payload.mov' -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing wmplayer.exe process creation with .mov file argument; DeviceProcessEvents in Defender for Endpoint capturing InitiatingProcessFileName=wmplayer.exe

Expected Detection

Should trigger the media player QuickTime file processing indicator in KQL and SPL queries

Test 2 Simulate Shell Process Spawn from Media Player Context
windows

Directly simulate the post-exploitation process chain by launching cmd.exe with wmplayer.exe as the parent process using WMI, mimicking the shell spawn that occurs after successful NULL byte overwrite exploitation.

Command

powershell 
$wmi = [wmiclass]'win32_process'; $startup = [wmiclass]'win32_processstartup'; $startup.Properties['ShowWindow'].Value = 0; $wmi.Create('cmd.exe /c whoami > C:\AtomicTests\cve_2009_1537_test.txt', $null, $startup)

Cleanup

powershell 
Remove-Item 'C:\AtomicTests\cve_2009_1537_test.txt' -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 with ParentImage containing wmplayer.exe and Image=cmd.exe; command line output file created in C:\AtomicTests\

Expected Detection

Should trigger parent-child shell spawn detection across KQL, SPL, and Elastic EQL queries

Test 3 Simulate quartz.dll File Modification Event
windows

Create a benign file named quartz.dll in a temp directory to simulate the file write telemetry that would be generated if an attacker overwrote the legitimate DirectX DLL during exploitation.

Command

powershell 
New-Item -Path 'C:\AtomicTests\quartz.dll' -ItemType File -Force; Set-Content -Path 'C:\AtomicTests\quartz.dll' -Value 'ATOMIC_TEST_CVE_2009_1537'

Cleanup

powershell 
Remove-Item 'C:\AtomicTests\quartz.dll' -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) with TargetFilename matching quartz.dll pattern; DeviceFileEvents showing FileName=quartz.dll with ActionType=FileCreated

Expected Detection

Should trigger the quartz.dll file event detection in KQL, SPL, and EQL queries; Chronicle YARA-L FILE_MODIFICATION event should fire

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1203Exploitation for Client ExecutionT1566.002Spearphishing LinkT1059.001PowerShell

Same Tactic: Initial Access

Popular Detections