CVE-2020-9715 Microsoft Sentinel · KQL

Detect Adobe Acrobat Use-After-Free Exploitation (CVE-2020-9715) in Microsoft Sentinel

Detects exploitation of CVE-2020-9715, a use-after-free vulnerability in Adobe Acrobat that allows arbitrary code execution. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and has been actively exploited in the wild. Attackers typically deliver malicious PDF documents that trigger memory corruption upon rendering, leading to code execution in the context of the Acrobat process.

MITRE ATT&CK

Tactic
Initial Access Execution Defense Evasion

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let AcrobatProcs = dynamic(["AcroRd32.exe", "Acrobat.exe", "AcroCEF.exe", "AcroNGL.exe"]);
let SuspChildProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe", "wmic.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (AcrobatProcs)
| where FileName in~ (SuspChildProcs)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, InitiatingProcessParentFileName
| extend AlertDetail = strcat("Adobe Acrobat spawned suspicious child process: ", FileName)
| order by TimeGenerated desc
critical severity high confidence

Detects Adobe Acrobat spawning suspicious child processes consistent with use-after-free exploitation leading to code execution. Targets Microsoft Defender for Endpoint telemetry.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel

Required Tables

DeviceProcessEvents

False Positives & Tuning

  • Acrobat plugins or extensions that legitimately spawn helper processes
  • IT automation tools that invoke Acrobat via command line and chain other processes
  • Security scanning tools that open PDFs and inspect spawned processes

Other platforms for CVE-2020-9715

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Acrobat UAF — Malicious PDF Spawning cmd.exe

    Expected signal: Sysmon Event ID 1 showing cmd.exe with ParentImage path containing AcroRd32; DeviceProcessEvents entry in MDE with InitiatingProcessFileName = AcroRd32_sim.exe and FileName = cmd.exe

  2. Test 2Simulate Acrobat UAF — PowerShell Payload Execution

    Expected signal: Sysmon Event ID 1 for powershell.exe with suspicious parent; DeviceProcessEvents capturing PowerShell command-line with -ExecutionPolicy Bypass flag

  3. Test 3Simulate Acrobat UAF — Executable Drop to Temp Directory

    Expected signal: Sysmon Event ID 11 (FileCreate) for executable written to %TEMP%; Sysmon Event ID 1 for process launch from %TEMP% path; MDE DeviceFileEvents and DeviceProcessEvents entries

  4. Test 4Simulate Acrobat UAF — Outbound C2 Beacon Simulation

    Expected signal: Sysmon Event ID 3 (NetworkConnect) for outbound connection to non-RFC1918 IP on non-standard port; DeviceNetworkEvents in MDE capturing the destination IP and port

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Confirm the process tree: verify that the suspicious child process (cmd.exe, powershell.exe, etc.) is directly parented by an Acrobat process and note the full command-line arguments of both parent and child.
  2. Identify the PDF file that triggered the Acrobat session — retrieve it from browser download history, email attachments, or recent file activity on the endpoint and quarantine it for analysis.
  3. Determine the user account involved, check for privilege escalation indicators, and assess whether the spawned process established network connections or dropped additional payloads to disk.
  4. Review the endpoint's patch level for Adobe Acrobat: confirm whether the affected version aligns with the known vulnerable build range for CVE-2020-9715 and check if apsb20-48 patches have been applied.

Containment

  1. Isolate the affected endpoint from the network immediately using EDR host isolation or network ACLs to prevent lateral movement or C2 beacon establishment from the potentially compromised Acrobat session.
  2. Kill all suspicious child processes spawned by Acrobat and terminate the Acrobat process itself; preserve memory dumps of both before termination if forensic tooling permits.
  3. Block the source PDF file hash at the email gateway, web proxy, and endpoint AV/EDR layers to prevent further delivery to other users.

Evidence Collection

  1. Collect a full memory dump of the Acrobat process and any spawned child processes prior to termination; use tools such as ProcDump or EDR memory acquisition to capture heap state for use-after-free analysis.
  2. Preserve the triggering PDF file intact (do not open outside a sandbox), capture prefetch files, browser download records, MFT entries, and Sysmon/EDR telemetry covering the 30-minute window around the alert.
  3. Export relevant Windows Event Logs (Security, System, Application, Sysmon) and EDR process telemetry for the affected host covering at least 24 hours before and after the incident.

Escalation Criteria

  • !Escalate immediately if the child process established outbound network connections, particularly to non-corporate external IPs, indicating potential C2 activity post-exploitation.
  • !Escalate if additional hosts exhibit the same Acrobat child-process pattern within the same timeframe, suggesting a phishing campaign or shared malicious PDF delivery to multiple users.
  • !Escalate if credential dumping tools (mimikatz, lsass access), persistence mechanisms (registry run keys, scheduled tasks), or lateral movement indicators are observed following the initial Acrobat alert.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Suspicious PDF file in user's Downloads directory, Temp folder, or browser cache — hash and submit to sandbox
  • >Acrobat process memory dump containing corrupted heap structures indicative of use-after-free condition
  • >Windows Prefetch entries for Acrobat and any spawned child processes with close timestamps
  • >Sysmon Event ID 1 (Process Create), Event ID 3 (Network Connection), and Event ID 11 (File Create) entries from the Acrobat process tree
  • >Registry modifications or scheduled tasks created by child processes post-exploitation for persistence

Tuning Guidance

Reduce false positives by filtering on known-good Acrobat child processes such as AcroNGL.exe, AcroBroker.exe, and legitimate Adobe Update processes. Scope alerts to exclude endpoints where Acrobat is used in automated document processing pipelines by creating exception lists based on process parent chain depth and command-line argument patterns. Increase confidence by correlating child process spawning with concurrent network connections from the same Acrobat PID. Consider tuning severity downward for endpoints confirmed to be running patched Acrobat versions (post-apsb20-48).

Hunting Queries

Hunt for Adobe Acrobat writing executable or script files to user-writable temp directories, a strong post-exploitation indicator following use-after-free code execution.

Hunting — KQL
kql 
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("AcroRd32.exe", "Acrobat.exe", "AcroCEF.exe")
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".bat"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256
| order by TimeGenerated desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11
| eval Image=lower(Image), TargetFilename=lower(TargetFilename)
| where (like(Image, "%acrobat%") OR like(Image, "%acrord32%"))
  AND (like(TargetFilename, "%.exe") OR like(TargetFilename, "%.dll") OR like(TargetFilename, "%.ps1") OR like(TargetFilename, "%.bat"))
  AND (like(TargetFilename, "%temp%") OR like(TargetFilename, "%appdata%") OR like(TargetFilename, "%programdata%"))
| table _time, host, User, Image, TargetFilename
| sort -_time

Hunt for Adobe Acrobat making unusual outbound network connections on non-standard ports to external IPs, indicative of C2 beacon activity following exploitation.

Hunting — KQL
kql 
DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("AcroRd32.exe", "Acrobat.exe", "AcroCEF.exe")
| where RemoteIPType != "Private"
| where RemotePort !in (80, 443)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc
Hunting — SPL
spl 
index=windows sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3
| eval Image=lower(Image)
| where (like(Image, "%acrobat%") OR like(Image, "%acrord32%"))
  AND NOT (DestinationPort=80 OR DestinationPort=443)
  AND NOT (like(DestinationIp, "10.%") OR like(DestinationIp, "192.168.%") OR like(DestinationIp, "172.16.%"))
| table _time, host, User, Image, DestinationIp, DestinationPort
| sort -_time

Atomic Red Team Tests

Test 1 Simulate Acrobat UAF — Malicious PDF Spawning cmd.exe
windows

Simulates the post-exploitation behavior of CVE-2020-9715 by launching cmd.exe as a child of a renamed Acrobat process to trigger process-lineage detections. Lab use only.

Command

powershell 
Copy-Item "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "$env:TEMP\AcroRd32_sim.exe"; Start-Process "$env:TEMP\AcroRd32_sim.exe" -ArgumentList '/A "page=1" NUL'; Start-Sleep 2; Start-Process cmd.exe -ArgumentList '/c whoami > $env:TEMP\acro_uaf_test.txt'

Cleanup

powershell 
Remove-Item "$env:TEMP\AcroRd32_sim.exe" -Force -ErrorAction SilentlyContinue; Remove-Item "$env:TEMP\acro_uaf_test.txt" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 showing cmd.exe with ParentImage path containing AcroRd32; DeviceProcessEvents entry in MDE with InitiatingProcessFileName = AcroRd32_sim.exe and FileName = cmd.exe

Expected Detection

Alert fires on KQL/SPL child-process detection rules; EDR behavioral rule for Acrobat spawning cmd.exe triggers within 60 seconds

Test 2 Simulate Acrobat UAF — PowerShell Payload Execution
windows

Simulates attacker use of PowerShell as a post-exploitation payload after gaining code execution through CVE-2020-9715, with Acrobat as the parent process. Lab use only.

Command

powershell 
Start-Process powershell.exe -ArgumentList '-NoProfile -ExecutionPolicy Bypass -Command "Write-Output exploitation-simulated | Out-File $env:TEMP\acro_ps_test.txt"' -Wait; $proc = Get-Process powershell | Select-Object -Last 1; Write-Output "Spawned PID: $proc.Id"

Cleanup

powershell 
Remove-Item "$env:TEMP\acro_ps_test.txt" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1 for powershell.exe with suspicious parent; DeviceProcessEvents capturing PowerShell command-line with -ExecutionPolicy Bypass flag

Expected Detection

Detection rule triggers on Acrobat-lineage PowerShell spawn; AMSI telemetry may also generate additional signal on the bypass flag

Test 3 Simulate Acrobat UAF — Executable Drop to Temp Directory
windows

Simulates post-exploitation file drop behavior where an attacker writes a payload executable to a user-writable temp directory after gaining code execution via CVE-2020-9715. Lab use only.

Command

powershell 
Copy-Item "C:\Windows\System32\calc.exe" "$env:TEMP\svchost32.exe"; Start-Process "$env:TEMP\svchost32.exe"

Cleanup

powershell 
Stop-Process -Name svchost32 -Force -ErrorAction SilentlyContinue; Remove-Item "$env:TEMP\svchost32.exe" -Force -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 11 (FileCreate) for executable written to %TEMP%; Sysmon Event ID 1 for process launch from %TEMP% path; MDE DeviceFileEvents and DeviceProcessEvents entries

Expected Detection

Hunting query for Acrobat writing executables to temp directories fires; endpoint behavioral rule for process execution from %TEMP% may also alert

Test 4 Simulate Acrobat UAF — Outbound C2 Beacon Simulation
windows

Simulates network callback behavior following CVE-2020-9715 exploitation where attacker shellcode initiates C2 communication. Triggers network-based detection hunts. Lab use only — use isolated test network.

Command

powershell 
Invoke-WebRequest -Uri 'http://198.51.100.1:4444/beacon' -Method GET -TimeoutSec 5 -ErrorAction SilentlyContinue; Write-Output 'Beacon attempt simulated'

Cleanup

powershell 
No persistent changes made; ensure test network isolation after exercise

Expected Telemetry

Sysmon Event ID 3 (NetworkConnect) for outbound connection to non-RFC1918 IP on non-standard port; DeviceNetworkEvents in MDE capturing the destination IP and port

Expected Detection

Network hunting query for Acrobat-lineage outbound connections on non-standard ports triggers; NGFW or proxy log entries for the test IP may appear

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0005Defense Evasion

Related Techniques

T1566.001Spearphishing AttachmentT1203Exploitation for Client ExecutionT1055Process InjectionT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections