CVE-2010-0249 Elastic Security · Elastic

Detect Microsoft Internet Explorer Use-After-Free Vulnerability (CVE-2010-0249) in Elastic Security

CVE-2010-0249 is a use-after-free vulnerability (CWE-416) in Microsoft Internet Explorer that allows remote attackers to execute arbitrary code via a specially crafted web page. This vulnerability was actively exploited in the wild (Operation Aurora) and is listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation typically involves a malicious HTML/JavaScript page that triggers memory corruption through manipulated DOM objects, enabling arbitrary code execution in the context of the logged-on user.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by host.name with maxspan=30s
  [process where process.name : "iexplore.exe" and event.type == "start"]
  [process where process.parent.name : "iexplore.exe" and
   process.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "regsvr32.exe", "rundll32.exe")]
critical severity high confidence

EQL sequence detecting Internet Explorer spawning high-risk child processes within a 30-second window, a strong indicator of drive-by exploitation consistent with CVE-2010-0249.

Data Sources

Elastic Endpoint SecurityWinlogbeat with Sysmon

Required Tables

logs-endpoint.events.process-*winlogbeat-*

False Positives & Tuning

  • Automated browser testing pipelines using Internet Explorer
  • Legacy enterprise portals that spawn helper applications from IE
  • DLP or monitoring agents injected into IE that spawn child utilities
  • Software installers that open IE and then launch cmd.exe for post-install steps

Other platforms for CVE-2010-0249

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate IE Use-After-Free Child Process Spawn

    Expected signal: Sysmon Event ID 1 showing cmd.exe with ParentImage pointing to iexplore.exe; file creation event for cve_2010_0249_test.txt in %TEMP%

  2. Test 2IE Spawning PowerShell Downloader (Post-Exploit Simulation)

    Expected signal: Sysmon Event ID 1 with ParentImage iexplore.exe and Image powershell.exe; command line containing -NonInteractive visible in process telemetry

  3. Test 3Anomalous IE Network Beacon on Non-Standard Port

    Expected signal: Sysmon Event ID 3 network connection event with InitiatingProcessFileName iexplore.exe and DestinationPort 4444; connection attempt logged even on failure

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm the affected host is running Internet Explorer and identify the version — check Add/Remove Programs or HKLM\SOFTWARE\Microsoft\Internet Explorer\Version registry key to determine if an unpatched IE version is present.
  2. Review process creation logs (Sysmon Event ID 1) on the alerted host for iexplore.exe spawning cmd.exe, powershell.exe, or other interpreters within a short time window around the alert timestamp.
  3. Check DNS query logs and proxy/firewall logs for the alerted endpoint around the alert time to identify any suspicious outbound connections to external IPs or domains from iexplore.exe, especially to rare or newly-registered domains.
  4. Determine if the user visited any external or unfamiliar web pages shortly before the alert — pull browser history from %LOCALAPPDATA%\Microsoft\Windows\History or proxy logs.

Containment

  1. Immediately isolate the affected endpoint from the network using EDR network containment or VLAN quarantine to prevent lateral movement or C2 communication while preserving the system for forensic analysis.
  2. Disable or block Internet Explorer on affected and at-risk systems via Group Policy (set 'Prevent running Internet Explorer' or push a GPO disabling IE shortcuts and file associations) until the patch MS10-002 is confirmed applied.

Evidence Collection

  1. Collect a full memory image of the affected host using a trusted forensic tool (e.g., WinPmem or Magnet RAM Capture) to preserve potential shellcode, heap spray artifacts, and injected payloads in memory before rebooting.
  2. Export Windows Event Logs (Security, System, Application, Sysmon) and browser artifacts (history, cache, typed URLs from NTUSER.DAT) from the affected host for timeline reconstruction and indicator extraction.

Escalation Criteria

  • !Escalate immediately if a reverse shell, beacon callback, or lateral movement activity is detected originating from the iexplore.exe process or any process it spawned — this indicates successful exploitation and active intrusion.
  • !Escalate if multiple endpoints show the same pattern simultaneously or if the affected user account has elevated privileges (Domain Admin, local admin) — breadth of exposure or privilege level significantly increases incident severity.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Internet Explorer crash dumps or Windows Error Reporting files in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportArchive — may contain stack traces revealing exploitation
  • >Prefetch files for cmd.exe, powershell.exe, or other interpreters with a recent first-run timestamp correlating with the iexplore.exe execution window (%SystemRoot%\Prefetch\)
  • >Suspicious files written to %TEMP%, %APPDATA%, or user profile directories by iexplore.exe child processes — likely dropped payloads or stagers
  • >Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) modified after the suspected exploitation time — persistence mechanism commonly added post-exploitation

Tuning Guidance

Reduce false positives by filtering known-good parent processes of iexplore.exe (e.g., Windows Explorer, scheduled task hosts) and by maintaining an allowlist of internal URLs or enterprise applications that legitimately invoke IE child processes. In environments where IE is fully deprecated and replaced by Edge or Chrome, any iexplore.exe child process spawn should be treated as high-confidence. Add process lineage depth (grandparent) to detections to distinguish between user-launched IE and programmatically launched IE from automation frameworks.

Hunting Queries

Hunt for Internet Explorer making outbound connections on non-standard ports, which may indicate C2 communication established after successful exploitation of CVE-2010-0249

Hunting — KQL
kql 
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "iexplore.exe"
| where RemotePort !in (80, 443)
| where ActionType == "ConnectionSuccess"
| summarize count(), make_set(RemoteIP), make_set(RemoteUrl) by DeviceName, InitiatingProcessCommandLine, bin(Timestamp, 1h)
| where count_ > 0
| sort by Timestamp desc
Hunting — SPL
spl 
index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
| eval Image=lower(coalesce(Image, image, ""))
| where Image LIKE "%iexplore.exe"
  AND NOT (DestinationPort=80 OR DestinationPort=443)
| stats count values(DestinationIp) as RemoteIPs values(DestinationPort) as Ports by host, User, Image
| sort -count

Atomic Red Team Tests

Test 1 Simulate IE Use-After-Free Child Process Spawn
windows

Simulates the post-exploitation behavior of CVE-2010-0249 by launching Internet Explorer and immediately spawning cmd.exe as a child, mimicking what shellcode execution would do after a successful use-after-free exploit.

Command

powershell 
Start-Process 'C:\Program Files\Internet Explorer\iexplore.exe' -ArgumentList 'about:blank'; Start-Sleep -Seconds 2; $ie = Get-Process iexplore | Select-Object -First 1; Start-Process cmd.exe -ArgumentList '/c whoami > C:\Windows\Temp\cve_2010_0249_test.txt'

Cleanup

powershell 
Stop-Process -Name iexplore -Force -ErrorAction SilentlyContinue; Remove-Item C:\Windows\Temp\cve_2010_0249_test.txt -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe with ParentImage pointing to iexplore.exe; file creation event for cve_2010_0249_test.txt in %TEMP%

Expected Detection

Alert fires on iexplore.exe → cmd.exe process lineage in KQL DeviceProcessEvents or Sysmon-based SPL query

Test 2 IE Spawning PowerShell Downloader (Post-Exploit Simulation)
windows

Simulates an attacker using PowerShell as a second-stage stager after exploiting CVE-2010-0249, by launching powershell.exe as a child of iexplore.exe with a download cradle command.

Command

powershell 
Start-Process 'C:\Program Files\Internet Explorer\iexplore.exe' -ArgumentList 'about:blank'; Start-Sleep -Seconds 2; Start-Process powershell.exe -ArgumentList '-NoProfile -NonInteractive -Command "Write-Output CVE-2010-0249-test-stager"' -WindowStyle Hidden

Cleanup

powershell 
Stop-Process -Name iexplore -Force -ErrorAction SilentlyContinue; Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 with ParentImage iexplore.exe and Image powershell.exe; command line containing -NonInteractive visible in process telemetry

Expected Detection

Alert fires on iexplore.exe → powershell.exe process chain in EQL sequence rule or Splunk SPL query

Test 3 Anomalous IE Network Beacon on Non-Standard Port
windows

Simulates a C2 callback from an IE process to a non-standard port, mimicking post-exploitation network activity after CVE-2010-0249 shellcode execution establishes a reverse connection.

Command

powershell 
Start-Process 'C:\Program Files\Internet Explorer\iexplore.exe' -ArgumentList 'about:blank'; Start-Sleep -Seconds 2; $client = New-Object System.Net.Sockets.TcpClient; try { $client.Connect('127.0.0.1', 4444) } catch {}; $client.Close()

Cleanup

powershell 
Stop-Process -Name iexplore -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 3 network connection event with InitiatingProcessFileName iexplore.exe and DestinationPort 4444; connection attempt logged even on failure

Expected Detection

Alert fires on IE non-standard port outbound connection in KQL DeviceNetworkEvents or Sysmon network event SPL query

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1203Exploitation for Client ExecutionT1189Drive-by CompromiseT1055Process Injection

Same Tactic: Initial Access

Popular Detections