Detect Adobe Acrobat Use-After-Free Exploitation (CVE-2020-9715) in Google Chronicle
Detects exploitation of CVE-2020-9715, a use-after-free vulnerability in Adobe Acrobat that allows arbitrary code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in the wild. Attackers typically deliver malicious PDF documents that trigger memory corruption upon rendering, leading to code execution in the context of the Acrobat process.
MITRE ATT&CK
YARA-L Detection Query
rule adobe_acrobat_uaf_child_process_cve_2020_9715 {
meta:
author = "df00tech Detection Engineering"
description = "Detects Adobe Acrobat spawning suspicious child processes, indicative of CVE-2020-9715 use-after-free exploitation"
severity = "CRITICAL"
priority = "HIGH"
events:
$proc.metadata.event_type = "PROCESS_LAUNCH"
$proc.principal.process.file.full_path = /(?i)(Acrobat\.exe|AcroRd32\.exe|AcroCEF\.exe|AcroNGL\.exe)$/
$child.metadata.event_type = "PROCESS_LAUNCH"
$child.principal.process.parent_process.file.full_path = /(?i)(Acrobat\.exe|AcroRd32\.exe|AcroCEF\.exe|AcroNGL\.exe)$/
$child.target.process.file.full_path = /(?i)(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|wmic\.exe)$/
$proc.metadata.collected_timestamp.seconds = $child.metadata.collected_timestamp.seconds
condition:
$proc and $child
}Chronicle YARA-L rule detecting Adobe Acrobat process launching suspicious child executables, consistent with use-after-free code execution from CVE-2020-9715.
Data Sources
Required Tables
False Positives & Tuning
- Automated document processing systems that use Acrobat as a rendering engine
- Acrobat plug-ins that spawn helper processes for form processing
- Red team or penetration test exercises involving PDF-based payloads
Other platforms for CVE-2020-9715
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Acrobat UAF — Malicious PDF Spawning cmd.exe
Expected signal: Sysmon Event ID 1 showing cmd.exe with ParentImage path containing AcroRd32; DeviceProcessEvents entry in MDE with InitiatingProcessFileName = AcroRd32_sim.exe and FileName = cmd.exe
- Test 2Simulate Acrobat UAF — PowerShell Payload Execution
Expected signal: Sysmon Event ID 1 for powershell.exe with suspicious parent; DeviceProcessEvents capturing PowerShell command-line with -ExecutionPolicy Bypass flag
- Test 3Simulate Acrobat UAF — Executable Drop to Temp Directory
Expected signal: Sysmon Event ID 11 (FileCreate) for executable written to %TEMP%; Sysmon Event ID 1 for process launch from %TEMP% path; MDE DeviceFileEvents and DeviceProcessEvents entries
- Test 4Simulate Acrobat UAF — Outbound C2 Beacon Simulation
Expected signal: Sysmon Event ID 3 (NetworkConnect) for outbound connection to non-RFC1918 IP on non-standard port; DeviceNetworkEvents in MDE capturing the destination IP and port
Unlock Pro Content
Get the full detection package for CVE-2020-9715 including response playbook, investigation guide, and atomic red team tests.