CVE-2009-3459 Microsoft Sentinel · KQL

Detect Adobe Acrobat and Reader Heap-Based Buffer Overflow (CVE-2009-3459) in Microsoft Sentinel

Detects exploitation of a heap-based buffer overflow vulnerability in Adobe Acrobat and Reader (CVE-2009-3459). This CISA KEV vulnerability allows attackers to execute arbitrary code via a crafted PDF file. Exploitation typically results in AcroRd32.exe or Acrobat.exe spawning unexpected child processes, making unusual network connections, or writing executable payloads to disk.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let suspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "svchost.exe", "explorer.exe"]);
let adobeProcs = dynamic(["AcroRd32.exe", "Acrobat.exe", "AcroBroker.exe"]);
union
(
  DeviceProcessEvents
  | where InitiatingProcessFileName has_any (adobeProcs)
  | where FileName has_any (suspiciousChildren)
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
  | extend DetectionReason = "Adobe Reader/Acrobat spawned suspicious child process"
),
(
  DeviceNetworkEvents
  | where InitiatingProcessFileName has_any (adobeProcs)
  | where RemotePort in (80, 443, 445, 4444, 8080, 8443)
  | where RemoteIPType != "Private"
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
  | extend DetectionReason = "Adobe Reader/Acrobat initiated outbound network connection"
),
(
  DeviceFileEvents
  | where InitiatingProcessFileName has_any (adobeProcs)
  | where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".bat" or FileName endswith ".ps1"
  | where FolderPath has_any ("\\Temp\\", "\\AppData\\", "\\Public\\", "\\Downloads\\")
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath
  | extend DetectionReason = "Adobe Reader/Acrobat dropped executable to writable path"
)
| summarize count() by TimeGenerated, DeviceName, AccountName, DetectionReason
| sort by TimeGenerated desc
critical severity high confidence

Detects Adobe Acrobat or Reader spawning suspicious child processes, making external network connections, or writing executables to writable directories — all indicators of heap overflow exploitation.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel DeviceProcessEventsMicrosoft Sentinel DeviceNetworkEventsMicrosoft Sentinel DeviceFileEvents

Required Tables

DeviceProcessEventsDeviceNetworkEventsDeviceFileEvents

False Positives & Tuning

  • Legitimate Adobe Reader updates or plugin installers may spawn child processes
  • Enterprise PDF workflows that trigger scripted post-processing via Adobe Reader
  • IT automation tools opening PDFs as part of document conversion pipelines

Other platforms for CVE-2009-3459

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Adobe Reader Spawning cmd.exe

    Expected signal: Sysmon Event ID 1: process creation with ParentImage matching AcroRd32.exe and Image matching cmd.exe; DeviceProcessEvents in Defender with InitiatingProcessFileName=AcroRd32.exe and FileName=cmd.exe.

  2. Test 2Simulate Adobe Reader Writing Executable to Temp

    Expected signal: Sysmon Event ID 11: TargetFilename=C:\Temp\payload.exe, Image matching AcroRd32.exe; DeviceFileEvents in Defender with InitiatingProcessFileName=AcroRd32.exe and FileName=payload.exe.

  3. Test 3Simulate Adobe Reader Making Outbound Network Connection

    Expected signal: Sysmon Event ID 3: Image matching AcroRd32.exe, DestinationIp=93.184.216.34, DestinationPort=80; DeviceNetworkEvents in Defender with InitiatingProcessFileName=AcroRd32.exe and non-RFC1918 RemoteIP.

  4. Test 4Open Malicious PDF in Sandboxed Adobe Reader (Lab Only)

    Expected signal: Heap spray artifacts in AcroRd32.exe memory; child process creation events; potential shellcode execution visible in memory forensics; network connection attempt if payload is weaponized.

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the host and user account involved; determine whether the PDF was received via email, web download, or removable media by reviewing email gateway logs and browser history.
  2. Inspect the parent process tree for AcroRd32.exe or Acrobat.exe to confirm the version of Adobe Reader/Acrobat installed and whether it falls within affected versions (pre-9.2 / pre-8.1.7).
  3. Review Sysmon Event ID 1 (process creation), Event ID 3 (network connection), and Event ID 11 (file creation) logs within a ±5 minute window around the alert timestamp to reconstruct the exploitation chain.
  4. Check for any scheduled tasks, registry run keys, or startup folder entries created around the time of the event that may indicate persistence establishment post-exploitation.

Containment

  1. Isolate the affected endpoint from the network immediately using EDR network containment or VLAN quarantine to prevent lateral movement or C2 beaconing.
  2. Kill any active child processes spawned by AcroRd32.exe or Acrobat.exe and preserve memory dumps of those processes before termination for forensic analysis.

Evidence Collection

  1. Collect the triggering PDF file from the user's downloads, temp directory, email attachment cache, or browser cache and submit to a sandboxed malware analysis environment.
  2. Acquire a full memory image of the affected endpoint and extract process memory for AcroRd32.exe or Acrobat.exe to identify shellcode, heap spray artifacts, or injected payloads.

Escalation Criteria

  • !Escalate to incident response if any child process made an outbound connection to an external IP or if a new executable or DLL was written to disk by Adobe Reader.
  • !Escalate immediately if multiple hosts exhibit the same pattern within a short time window, indicating a phishing campaign or watering hole attack distributing the malicious PDF at scale.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Malicious PDF file in %TEMP%, %APPDATA%\Local\Temp, browser cache, or Outlook attachment temp folder (search for files with .pdf extension written around alert time by Adobe Reader process).
  • >Windows Prefetch files for cmd.exe, powershell.exe, or other LOLBins with a parent reference to AcroRd32.exe, located in C:\Windows\Prefetch\.
  • >Registry run keys or scheduled tasks created within 5 minutes of the alert: HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, and Task Scheduler event logs.

Tuning Guidance

Start with high-severity alerting only on confirmed suspicious child processes (cmd.exe, powershell.exe, mshta.exe) spawned by Adobe Reader. The network and file-drop rules may generate more noise in environments with Adobe Acrobat Pro used for document automation — consider suppressing alerts where the child process command line matches known internal document processing scripts or where the destination IP is a known corporate update server. If Adobe Reader is not part of the approved software inventory, consider blocking AcroRd32.exe execution via application control policy, which would eliminate false positives entirely.

Hunting Queries

Broad 30-day retrospective hunt for any Adobe Reader or Acrobat process spawning command-line interpreters or LOLBins — surfaces both active exploitation and previously undetected compromise across the estate.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "AcroRd32.exe" or InitiatingProcessFileName =~ "Acrobat.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe", "rundll32.exe")
| summarize count() by DeviceName, AccountName, FileName, InitiatingProcessCommandLine
| sort by count_ desc
Hunting — SPL
spl 
index=* sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage)
| where match(parent, "acrord32\.exe|acrobat\.exe|acrobroker\.exe")
| eval child=lower(Image)
| where match(child, "cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe")
| stats count by host, parent, child, CommandLine
| sort -count

Atomic Red Team Tests

Test 1 Simulate Adobe Reader Spawning cmd.exe
windows

Mimics CVE-2009-3459 post-exploitation behavior by launching cmd.exe as a child of a renamed AcroRd32.exe process to test detection coverage without requiring a real vulnerable binary.

Command

powershell 
Copy-Item "C:\Windows\System32\cmd.exe" "$env:TEMP\AcroRd32.exe"; Start-Process "$env:TEMP\AcroRd32.exe" -ArgumentList '/c whoami > C:\Temp\test_output.txt'

Cleanup

powershell 
Remove-Item "$env:TEMP\AcroRd32.exe" -Force -ErrorAction SilentlyContinue; Remove-Item "C:\Temp\test_output.txt" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: process creation with ParentImage matching AcroRd32.exe and Image matching cmd.exe; DeviceProcessEvents in Defender with InitiatingProcessFileName=AcroRd32.exe and FileName=cmd.exe.

Expected Detection

Alert fires on KQL rule matching InitiatingProcessFileName=AcroRd32.exe spawning cmd.exe; SPL rule triggers on ParentImage/Image pair.

Test 2 Simulate Adobe Reader Writing Executable to Temp
windows

Simulates the file-drop behavior that follows successful heap overflow exploitation — an executable written to %TEMP% by a process named AcroRd32.exe.

Command

powershell 
Copy-Item "C:\Windows\System32\cmd.exe" "$env:TEMP\AcroRd32.exe"; & "$env:TEMP\AcroRd32.exe" /c 'echo MZ > C:\Temp\payload.exe'

Cleanup

powershell 
Remove-Item "$env:TEMP\AcroRd32.exe" -Force -ErrorAction SilentlyContinue; Remove-Item "C:\Temp\payload.exe" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11: TargetFilename=C:\Temp\payload.exe, Image matching AcroRd32.exe; DeviceFileEvents in Defender with InitiatingProcessFileName=AcroRd32.exe and FileName=payload.exe.

Expected Detection

File-drop branch of KQL/SPL rules fires; alert includes path and initiating process details.

Test 3 Simulate Adobe Reader Making Outbound Network Connection
windows

Tests network-based detection by having a process named AcroRd32.exe initiate an HTTP connection to an external IP, simulating C2 callback after exploitation.

Command

powershell 
Copy-Item "C:\Windows\System32\cmd.exe" "$env:TEMP\AcroRd32.exe"; & "$env:TEMP\AcroRd32.exe" /c 'powershell -NoProfile -Command "Invoke-WebRequest -Uri http://93.184.216.34 -TimeoutSec 5 -ErrorAction SilentlyContinue"'

Cleanup

powershell 
Remove-Item "$env:TEMP\AcroRd32.exe" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 3: Image matching AcroRd32.exe, DestinationIp=93.184.216.34, DestinationPort=80; DeviceNetworkEvents in Defender with InitiatingProcessFileName=AcroRd32.exe and non-RFC1918 RemoteIP.

Expected Detection

Network egress branch of KQL/SPL/Elastic rules fires; CrowdStrike NetworkConnectIP4 alternate query surfaces the connection.

Test 4 Open Malicious PDF in Sandboxed Adobe Reader (Lab Only)
windows

In a fully isolated lab environment with a vulnerable version of Adobe Reader (pre-9.2), open a known CVE-2009-3459 proof-of-concept PDF to validate detection against real exploitation telemetry.

Command

powershell 
& 'C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe' 'C:\TestPDFs\cve-2009-3459-poc.pdf'

Cleanup

powershell 
Kill AcroRd32.exe process tree; restore VM snapshot to pre-test state.

Expected Telemetry

Heap spray artifacts in AcroRd32.exe memory; child process creation events; potential shellcode execution visible in memory forensics; network connection attempt if payload is weaponized.

Expected Detection

All detection rules should fire if exploitation succeeds; memory forensics tools (Volatility) should surface heap spray and shellcode injection artifacts.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1203Exploitation for Client ExecutionT1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections