--- title: "CVE-2008-0015: CISA Adds Actively Exploited Microsoft Video ActiveX Stack Overflow to KEV Catalog" url: https://radicalnotion.ai/blog/cve-2008-0015-cisa-adds-actively-exploited-microsoft-video-activex-stack-overflow-to-kev-catalog-20260218175434 type: article description: "CISA added CVE-2008-0015 to its Known Exploited Vulnerabilities catalog on February 17, 2026, confirming active exploitation of a critical stack-based buffer overflow in Microsoft's Video ActiveX control that allows complete system takeover via a malicious webpage." updated: 2026-02-18 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # CVE-2008-0015: CISA Adds Actively Exploited Microsoft Video ActiveX Stack Overflow to KEV Catalog By Radical Notion Team, 2026-02-18 *CISA added CVE-2008-0015 to its Known Exploited Vulnerabilities catalog on February 17, 2026, confirming active exploitation of a critical stack-based buffer overflow in Microsoft's Video ActiveX control that allows complete system takeover via a malicious webpage.* CISA's addition of CVE-2008-0015 to its Known Exploited Vulnerabilities catalog on February 17, 2026 is a stark reminder that legacy Windows vulnerabilities never truly go away — and that unpatched systems running Windows XP, Windows Server 2003, and even Windows Vista and Server 2008 remain live targets. The flaw, a stack-based buffer overflow buried deep inside the `CComVariant::ReadFromStream` function of Microsoft's Active Template Library (ATL) — as exposed through the MPEG2TuneRequest ActiveX control in `msvidctl.dll` — allows a remote, unauthenticated attacker to execute arbitrary code on a vulnerable machine simply by luring the victim to a malicious webpage. No downloads. No macro prompts. Just a browser visit. According to CISA's Vulnrichment metadata published alongside the KEV entry, exploitation of CVE-2008-0015 is confirmed active, carries a CVSS 3.1 base score of **8.8 (HIGH)** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`), and results in **total technical impact** — meaning a successful attacker gains full confidentiality, integrity, and availability compromise of the affected system. CISA's own SSVC assessment flags this as requiring immediate action for federal agencies, and by extension, any organization still operating the affected software stack. --- ## What Happened CVE-2008-0015 was originally assigned in December 2007 and publicly disclosed on July 7, 2009, when Microsoft released Security Bulletin **MS09-032** (KB973346). The vulnerability centers on `msvidctl.dll`, the dynamic-link library that implements Microsoft's Video ActiveX control — a component of DirectShow, the Windows multimedia framework used to play back and process audio and video streams. The vulnerability was being actively exploited in the wild at the exact moment Microsoft published its bulletin. US-CERT issued Technical Alert **TA09-187A** on July 6, 2009 — one day before the official patch — confirming that exploit code was already circulating and that drive-by download campaigns were underway targeting Windows XP and Server 2003 users. CERT issued advisory **VU#180513** corroborating the exploitation, noting that attackers were delivering malicious HTML via both compromised websites and email-based phishing campaigns. The timing was not accidental. The same underlying flaw in Microsoft's Active Template Library (ATL) that powers `msvidctl.dll` also affected a sweeping range of other Windows components. Microsoft addressed the broader ATL root cause in a second bulletin, **MS09-037**, released on August 11, 2009 — the same Patch Tuesday that also delivered an ATL developer advisory (**MS09-035**) urging third-party software vendors to recompile their own ActiveX and COM components against the patched ATL headers. The Microsoft Security Response Center blog post explaining why MS09-037 reused CVE numbers from MS09-035 provides important context: the CVEs were originally assigned to describe ATL flaws that were then found to manifest in multiple shipping components, requiring a complex, multi-bulletin remediation. Now, in February 2026, CISA's KEV addition confirms that threat actors are once again — or perhaps continuously — weaponizing this vulnerability against systems that remain unpatched. Given the large installed base of legacy Windows systems in operational technology (OT), industrial control system (ICS), and healthcare environments, this is a credible and serious threat. --- ## Understanding the Vulnerability ### The Root Cause: `CComVariant::ReadFromStream` To understand CVE-2008-0015, you need to understand what the Active Template Library is and why its flaws are so dangerous. ATL is a set of C++ template classes and macros provided by Microsoft that developers use to build ActiveX controls and COM (Component Object Model) components. Think of it as a framework — a shortcut for developers who want to create small, embeddable software objects that can be hosted inside Internet Explorer, Office documents, or other Windows applications. When a developer writes an ATL-based ActiveX control, they link in ATL's code, which becomes part of their compiled binary. This means that any flaw in the ATL source code propagates to every compiled component that used it. The specific flaw in CVE-2008-0015 lives in the `CComVariant::ReadFromStream` function — an ATL helper routine that reads a VARIANT (a generic data container used throughout COM programming) from a stream. The function is supposed to read a type tag from the stream, then read the corresponding data. The problem: it does not validate the size of the data it is about to read from the stream before copying that data onto the stack. This is a classic **stack-based buffer overflow** (CWE-121). When an attacker supplies a crafted COM data stream with a malformed VARIANT record, `CComVariant::ReadFromStream` copies more data onto the stack than the buffer can hold. This overwrites adjacent stack memory, including — critically — the **Structured Exception Handler (SEH) chain**. The SEH chain is Windows' mechanism for handling runtime errors; overwriting it gives an attacker a reliable path to redirect execution to attacker-controlled shellcode. The official CVE description from the NVD captures this precisely: The ATL flaw is not limited to `ReadFromStream`. Microsoft's MS09-037 bulletin and the MS09-035 developer advisory identified a family of related ATL vulnerabilities: 1. `CComVariant::ReadFromStream` — Reads untrusted data directly onto the stack without bounds checking (the core CVE-2008-0015 flaw). 2. `IPersistStreamInit::Load` — Performs an unchecked `memcpy` when loading persistent state from a stream. 3. `VariantClear` **on uninitialized VARIANTs** — Calling `VariantClear` on a VARIANT that was never properly initialized can lead to use-of-uninitialized-memory conditions. 4. `OleLoadFromStream` — Used to load an object from a stream; insufficient validation allows corruption of the loading process. 5. **Invalid variant type from stream** — Reading an invalid or attacker-specified variant type can cause heap or stack corruption downstream. Because any ActiveX control or COM component compiled with the vulnerable ATL version inherits all of these flawed code paths, the attack surface extends far beyond `msvidctl.dll` to include Outlook Express, Windows Media Player, the DHTML Editing Component, the MSWebDVD control, and the HtmlInput Object control — all addressed in MS09-037. ### Why `msvidctl.dll` Is the Critical Attack Vector `msvidctl.dll` is the Microsoft Video ActiveX control that ships with Windows as part of DirectShow. It exposes **45 separate CLSIDs** (Component Object Model class identifiers), and critically, many of those CLSIDs are registered as **Safe for Scripting** and **Safe for Initialization**. This registration tells Internet Explorer: "This control is safe to load automatically when a webpage asks for it — don't prompt the user." The control was never designed to be instantiated inside a web browser. It was intended for use by Windows Media Center and similar multimedia applications. But because of its COM registration, Internet Explorer will happily load it when any webpage includes an `` tag referencing one of its CLSIDs. And once loaded, the flaw in `CComVariant::ReadFromStream` can be triggered by the stream data the webpage supplies to the control. Here is a simplified representation of what a malicious HTML page exploiting this vulnerability looks like conceptually: ```html ``` *The above is a conceptual illustration. No public proof-of-concept exploit code for CVE-2008-0015 has been released. However, CERT advisory VU#180513, US-CERT alerts TA09-187A and TA09-195A, and IBM ISS X-Force (who originally reported the vulnerability, credited to researchers Ryan Smith and Alex Wheeler) all confirm that functional exploits were circulating privately and used in active campaigns as early as July 2009.* ### Step-by-Step Attack Chain The full exploitation sequence, as described by Microsoft Security Bulletin MS09-032, US-CERT technical alerts, and CERT advisory VU#180513, proceeds as follows: **Step 1: Attacker prepares malicious content.** The attacker creates an HTML page (or HTML email) containing an `` tag referencing one of the 45 vulnerable CLSIDs exposed by `msvidctl.dll`. The page also contains crafted stream data — a specially formatted COM data stream with a malformed VARIANT record designed to trigger the `CComVariant::ReadFromStream` overflow. **Step 2: Delivery to the victim.** The attacker delivers the malicious content via one or more vectors: - A compromised legitimate website (drive-by download) - A phishing email containing malicious HTML content - A link in an instant message or social engineering lure - Any other mechanism that causes Internet Explorer to render the page **Step 3: Internet Explorer instantiates the control.** When the victim opens the page with Internet Explorer on an affected Windows version, IE encounters the `` tag. Because the referenced CLSID is registered as Safe for Scripting and Safe for Initialization, IE loads `msvidctl.dll` and instantiates the ActiveX control **automatically, without any user prompt**. **Step 4: The control processes the crafted stream.** Internet Explorer passes attacker-controlled data to the instantiated control. The control calls `CComVariant::ReadFromStream` to process a VARIANT from the supplied stream. The function reads the attacker's oversized data directly onto the stack without checking the size first. **Step 5: Stack buffer overflow and SEH overwrite.** The excess data overflows the stack buffer and overwrites the SEH (Structured Exception Handler) chain. The attacker has positioned their shellcode pointer at precisely the right offset to overwrite the SEH handler address. **Step 6: Arbitrary code execution.** When the overflowed function triggers an exception (which the attacker can force), Windows attempts to execute the overwritten SEH handler — which now points to the attacker's shellcode. The shellcode runs with the full privileges of the logged-on user. If the user is an administrator (common on older Windows XP configurations), the attacker achieves complete system compromise. --- ## Who Is Affected The following table summarizes all affected products and their corresponding patches, compiled from Microsoft Security Bulletins MS09-032 and MS09-037, confirmed by OVAL definitions and US-CERT technical alerts: ### MS09-032 (CVE-2008-0015 — Primary Video ActiveX Vulnerability) | | | | | | | --- | --- | --- | --- | --- | | | | | | | | | | | | | | | | | | | | | | | | | | Microsoft | Windows XP | SP2, SP3, Professional x64 Edition SP2 | KB973346 | Primary attack surface | | Microsoft | Windows Server 2003 | SP2, x64 Edition SP2, Itanium-based Systems SP2 | KB973346 | Primary attack surface | | Microsoft | Windows Vista | Gold, SP1, SP2 | KB973346 | Control present but **cannot be instantiated from IE**; lower risk | | Microsoft | Windows Server 2008 | Gold, SP2 | KB973346 | Control present but **cannot be instantiated from IE**; lower risk | | Microsoft | Windows 2000 | SP4 | KB973346 | Affected | ### MS09-037 (Broader ATL Component Fixes — Related Root Cause) | | | | | | --- | --- | --- | --- | | | | | | | | | | | | | | | | | Microsoft | Windows 2000 SP4 | Outlook Express 5.5 SP2 / 6 SP1 | KB973354 | | Microsoft | Windows 2000 SP4 | Windows Media Player 9 | KB973540 | | Microsoft | Windows 2000 SP4 | Windows ATL Component | KB973507 | | Microsoft | Windows 2000 SP4 | DHTML Editing Component ActiveX Control | KB973869 | | Microsoft | Windows 2000 SP4 | MSWebDVD ActiveX Control | KB973815 | | Microsoft | Windows XP SP2/SP3 | Outlook Express 6 | KB973354 | | Microsoft | Windows XP SP2/SP3 | Windows Media Player 9/10/11 | KB973540 | | Microsoft | Windows XP SP2/SP3 | Windows ATL Component | KB973507 | | Microsoft | Windows XP SP2/SP3 | DHTML Editing Component ActiveX Control | KB973869 | | Microsoft | Windows XP SP2/SP3 | MSWebDVD ActiveX Control | KB973815 | | Microsoft | Windows XP Media Center Edition 2005 | HtmlInput Object ActiveX Control | KB973768 | | Microsoft | Windows Server 2003 SP2 | Outlook Express 6 | KB973354 | | Microsoft | Windows Server 2003 SP2 | Windows Media Player 10 | KB973540 | | Microsoft | Windows Server 2003 SP2 | Windows ATL Component | KB973507 | | Microsoft | Windows Server 2003 SP2 | DHTML Editing Component ActiveX Control | KB973869 | | Microsoft | Windows Server 2003 SP2 | MSWebDVD ActiveX Control | KB973815 | | Microsoft | Windows Vista | Windows Media Player 11 | KB973540 | | Microsoft | Windows Vista | Windows ATL Component | KB973507 | | Microsoft | Windows Vista | HtmlInput Object ActiveX Control | KB973768 | | Microsoft | Windows Server 2008 | Windows Media Player 11 | KB973540 | | Microsoft | Windows Server 2008 | Windows ATL Component | KB973507 | | Microsoft | Microsoft Office (various editions) | ATL-based ActiveX components embedded in Office | KB973507 and related | | Microsoft | Remote Desktop Connection Client for Mac 2.0 | ATL-based components | Vendor-provided update | ### Key Clarification on Vista and Server 2008 Microsoft's MS09-032 bulletin notes that Windows Vista and Windows Server 2008 are **not vulnerable to exploitation via Internet Explorer** for the specific `msvidctl.dll` attack vector, because those operating systems implement restrictions that prevent the Video ActiveX control from being instantiated inside IE. However, the underlying ATL code flaws remain present in other components on those platforms, which is why MS09-037 still delivers patches for Vista and Server 2008 covering Windows Media Player, the ATL Component, and the HtmlInput Object. This is an important distinction: organizations running Vista or Server 2008 **are not in the clear** — they need the MS09-037 patches to address the ATL root cause across other attack surfaces. --- ## Real-World Risk ### Confirmed Active Exploitation — Then and Now CVE-2008-0015 has a well-documented history of active exploitation. According to US-CERT Technical Alert TA09-187A, published July 6, 2009 — one day before Microsoft's own bulletin — the vulnerability was already being exploited in the wild. IBM ISS X-Force researchers Ryan Smith and Alex Wheeler originally reported the flaw to Microsoft through private disclosure, but attackers had independently discovered and weaponized it before the patch was ready. US-CERT Technical Alert TA09-195A further confirmed drive-by download campaigns targeting Windows XP and Server 2003 users through July 2009. CERT advisory VU#180513 documented multiple email-based phishing campaigns delivering malicious HTML that instantiated the vulnerable control, with first confirmed in-the-wild exploitation observed as early as July 4, 2009. CISA's addition of CVE-2008-0015 to the Known Exploited Vulnerabilities catalog on **February 17, 2026** — nearly 17 years after the original disclosure — confirms that exploitation is once again (or continuously) occurring. This is consistent with a well-established pattern in which threat actors, particularly ransomware groups and initial access brokers, aggressively scan for and exploit unpatched legacy systems in healthcare, manufacturing, utilities, and other sectors that maintain older Windows deployments for compatibility reasons. ### What an Attacker Can Do Successful exploitation of CVE-2008-0015 gives the attacker code execution with the **same privileges as the logged-on user**. On the majority of Windows XP systems — where users routinely ran as local administrators — this meant immediate full system compromise. Specifically, a successful attacker can: - **Install malware persistently**: Backdoors, remote access trojans (RATs), keyloggers, and ransomware can all be installed without further interaction. - **Steal credentials**: The attacker can dump Windows credential stores, harvest browser-saved passwords, and capture any credentials typed by the user. - **Exfiltrate data**: Any file accessible to the compromised user account can be exfiltrated — including intellectual property, personally identifiable information (PII), financial records, and corporate documents. - **Move laterally**: With valid credentials harvested from the compromised host, the attacker can pivot to other systems on the same network, potentially reaching domain controllers, file servers, and database systems. - **Establish persistence**: New administrator accounts can be created, scheduled tasks installed, and Windows services registered to ensure the attacker maintains access even after reboots. - **Disable security controls**: Antivirus software, Windows Firewall, and audit logging can all be disabled by an attacker operating with administrative privileges. ### Worst-Case Scenario In an enterprise environment where a privileged user — a domain administrator, a service account with broad permissions, a database administrator — visits a malicious webpage or opens a malicious email in Internet Explorer, the attacker can leverage CVE-2008-0015 to achieve immediate domain-level compromise. From a single exploited workstation, an attacker with domain admin credentials can compromise the entire Active Directory forest, deploy ransomware to all domain-joined systems, and exfiltrate years of corporate data within hours. For organizations in critical infrastructure sectors — power generation, water treatment, oil and gas, healthcare — where legacy Windows systems running XP or Server 2003 are common due to compatibility requirements with specialized industrial software, this vulnerability represents an existential operational risk. ### Threat Actor Interest and Campaigns While public attribution of specific threat actor groups exploiting CVE-2008-0015 in 2026 remains limited in the available intelligence, CISA's KEV addition is predicated on confirmed exploitation evidence. Historical exploitation involved unattributed cybercrime groups operating exploit kits — automated attack frameworks that scan for and exploit known vulnerabilities in visiting browsers. US-CERT alerts noted the involvement of "malicious web-hosting campaigns distributing crafted HTML/JS pages targeting IE users" and multiple drive-by download operations. The CSIS Denmark advisory corroborated reports of active exploitation before patches were released. ISS X-Force published a research note titled "Multiple Microsoft Video Control ActiveX Remote Code Execution Vulnerabilities" on July 6, 2009, confirming the exploitation was widespread enough to merit an out-of-band advisory. In the modern threat landscape, legacy ActiveX vulnerabilities frequently appear in the toolkits of initial access brokers who specialize in compromising industrial and healthcare networks, where legacy Windows systems are most prevalent. The CISA KEV classification carries mandatory remediation timelines for U.S. federal agencies under Binding Operational Directive 22-01, and CISA strongly urges all organizations to treat KEV entries as high-priority remediation targets regardless of federal status. --- ## What You Should Do ### Immediate Actions (Within 24 Hours) **1. Assess Your Exposure** Run an immediate inventory to identify any systems in your environment running: - Windows XP (any service pack) - Windows Server 2003 (any edition or service pack) - Windows 2000 SP4 - Windows Vista (for the broader ATL component risk) - Windows Server 2008 (for the broader ATL component risk) Pay particular attention to systems where Internet Explorer is the default or only available browser, and to any system where users regularly access external web content. **2. Apply the Kill-Bit Mitigation Immediately** If you cannot deploy the full patch immediately, Microsoft's Security Advisory 972890 provides a "Fix-it" utility that sets registry kill-bits for all 45 vulnerable CLSIDs exposed by `msvidctl.dll`. Setting a kill-bit prevents Internet Explorer from instantiating the corresponding ActiveX control, completely blocking the exploitation path for the Video ActiveX attack vector. To set the kill-bit manually for the primary MPEG2TuneRequest CLSID, add the following registry value: ```plaintext Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0955AC62-BF2E-4CBA-A2B9-A63F772D46CF}] "Compatibility Flags"=dword:00000400 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0B5B5F03-6A0F-11D1-8FDF-00C04FB6B2E8}] "Compatibility Flags"=dword:00000400 ; Microsoft's advisory 972890 lists all 45 CLSIDs that require kill-bits. ; Apply the fix-it from KB972890 to address the full set automatically. ``` *: Setting kill-bits disables the controls in Internet Explorer. On the vast majority of systems, these controls are not used for any legitimate purpose. Windows Media Center functionality may be affected in rare configurations.* **3. Disable ActiveX in the Internet Zone** As an additional defense-in-depth measure, configure Internet Explorer to disable or prompt for ActiveX controls in the Internet security zone: - Open Internet Explorer → Tools → Internet Options → Security tab - Select the **Internet** zone - Click **Custom Level** - Under **ActiveX controls and plug-ins**: - Click OK and apply This can also be enforced via Group Policy across your organization: ```plaintext Computer Configuration → Administrative Templates → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Internet Zone → "Initialize and script ActiveX controls not marked as safe" → Disabled ``` ### Patching Instructions **Primary Patch — MS09-032 (KB973346)** This bulletin addresses CVE-2008-0015 specifically by deploying kill-bits for the vulnerable `msvidctl.dll` CLSIDs at the operating system level, ensuring the control cannot be instantiated in Internet Explorer regardless of user-level settings. - **Download URL**: https://support.microsoft.com/kb/973346 - **Bulletin**: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-032 - **Release date**: July 14, 2009 (initial release); August 11, 2009 (updated re-release) - **Applies to**: Windows XP SP2/SP3, Windows Server 2003 SP2, Windows 2000 SP4, Windows Vista, Windows Server 2008 **Broader ATL Remediation — MS09-037 (Multiple KBs)** This bulletin addresses the underlying ATL root cause across multiple components. All of the following updates should be applied, as applicable to your environment: | | | | | --- | --- | --- | | | | | | | | | | KB973354 | Outlook Express 5.5 / 6 | https://support.microsoft.com/kb/973354 | | KB973540 | Windows Media Player 9 / 10 / 11 | https://support.microsoft.com/kb/973540 | | KB973507 | Windows ATL Component (core ATL DLL) | https://support.microsoft.com/kb/973507 | | KB973869 | DHTML Editing Component ActiveX Control | https://support.microsoft.com/kb/973869 | | KB973815 | MSWebDVD ActiveX Control | https://support.microsoft.com/kb/973815 | | KB973768 | HtmlInput Object ActiveX Control | https://support.microsoft.com/kb/973768 | **Deployment via WSUS/SCCM** For enterprise environments, deploy these updates through Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager (SCCM/MECM), or equivalent patch management infrastructure. Approval and deployment should be treated as **critical priority** given the CISA KEV classification. Verify deployment status using Microsoft Baseline Security Analyzer (MBSA) or your endpoint management platform's compliance reporting. Any system lacking KB973346 on an affected OS version should be flagged as critically non-compliant. **Third-Party Components** Organizations that develop or deploy custom ActiveX controls or COM components built with Visual Studio and ATL must also recompile those components against the updated ATL headers provided in MS09-035. This is a developer-level remediation step. The Microsoft TechNet Security Response blog post at `http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx` explains the relationship between MS09-035 and MS09-037 and the rationale for CVE reuse across bulletins. ### Detection Recommendations **Indicators of Compromise** The following indicators suggest a system may have been targeted by or successfully exploited via CVE-2008-0015: - Unexpected loading of `msvidctl.dll` by `iexplore.exe` (visible in process memory maps or EDR telemetry) - Application crash events (Windows Event ID 1000) with `msvidctl.dll` or `msvidctl32.dll` listed as the faulting module, followed shortly by unexpected new process creation - Unexpected COM registration entries for CLSIDs associated with `msvidctl.dll` appearing under `HKCR\CLSID\` - Outbound network connections from `iexplore.exe` to previously unseen external IP addresses or domains, particularly shortly after a user visits an external website - New services, scheduled tasks, or registry Run keys appearing under the compromised user's SID shortly after a browser session - Windows Event ID 4688 (process creation) showing `iexplore.exe` spawning `cmd.exe`, `powershell.exe`, `cscript.exe`, or `wscript.exe` without user interaction - IE security zone event logs (Event IDs 8000-8005) showing ActiveX control load failures or crashes for CLSIDs in the `msvidctl.dll` family **Detection Rules** For SIEM and XDR platforms, implement the following detection logic: ```yaml # Sigma Rule: Suspicious msvidctl.dll Load in Internet Explorer title: Microsoft Video ActiveX Control (msvidctl.dll) Load in IE status: stable description: Detects the loading of msvidctl.dll within the Internet Explorer process, which may indicate exploitation of CVE-2008-0015 logsource: category: process_access product: windows detection: selection: TargetImage|contains: 'iexplore.exe' CallTrace|contains: 'msvidctl.dll' condition: selection falsepositives: - Legitimate Windows Media Center usage via IE (extremely rare) level: high tags: - attack.execution - attack.t1203 - cve.2008-0015 ``` ```yaml # Sigma Rule: Suspicious Child Process from Internet Explorer title: IE Spawning Suspicious Child Process (Possible CVE-2008-0015 Exploitation) status: stable description: Detects Internet Explorer spawning command-line tools or script interpreters, which may indicate successful ActiveX exploitation logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: 'iexplore.exe' selection_child: Image|endswith: - 'cmd.exe' - 'powershell.exe' - 'cscript.exe' - 'wscript.exe' - 'mshta.exe' - 'rundll32.exe' condition: selection_parent and selection_child falsepositives: - Some legacy enterprise web applications may trigger this level: high tags: - attack.execution - attack.t1059 - cve.2008-0015 ``` ```yaml # Sigma Rule: Kill-Bit Registry Modification for msvidctl CLSIDs title: ActiveX Kill-Bit Registry Modification for msvidctl CLSIDs status: stable description: Detects registry modifications setting compatibility flags (kill-bits) for CLSIDs associated with msvidctl.dll, which may indicate either exploitation attempts or application of the MS09-032 mitigation logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - 'Internet Explorer\ActiveX Compatibility' Details: 'DWORD (0x00000400)' condition: selection falsepositives: - Application of the legitimate MS09-032 patch or KB972890 fix-it level: informational tags: - cve.2008-0015 - mitigation.tracking ``` **YARA Rule for Network-Level Detection** For network-based detection (IDS/IPS, web proxy inspection), flag HTTP responses containing references to the known vulnerable CLSIDs associated with `msvidctl.dll`: ```plaintext rule CVE_2008_0015_MSVIDCTL_CLSID_Reference { meta: description = "Detects HTML/JavaScript references to msvidctl.dll CLSIDs" cve = "CVE-2008-0015" severity = "HIGH" strings: // Key CLSID associated with MPEG2TuneRequest in msvidctl.dll $clsid1 = "0955AC62-BF2E-4CBA-A2B9-A63F772D46CF" nocase $clsid2 = "0B5B5F03-6A0F-11D1-8FDF-00C04FB6B2E8" nocase $clsid3 = "011B3619-FE63-4814-8A84-15A194CE9CE3" nocase $clsid4 = "0149EEDF-D08F-4142-8D73-D23903D21E90" nocase $clsid5 = "6BF52A52-394A-11d3-B153-00C04F79FAA6" nocase // Object tag pattern $object_tag = "