Describe the behaviour you want to detect. SARA writes a starting Sigma rule with MITRE tags, false-positive guidance, and detection-engineering context. Anonymous, no account, best-effort generic detection.
title: Potential CVE-2009-1537 Exploitation via Office Web Components ActiveX
id: 52c62ea7-ca08-490c-af54-654ecab3e87a
status: experimental
description: |
Detects potential exploitation of CVE-2009-1537 (CISA KEV listed), a remote code execution vulnerability in Microsoft Office Web Components (OWC) ActiveX controls.
This rule looks for the instantiation of the vulnerable OWC10.dll or OWC11.dll controls by Office applications or Internet Explorer, which may indicate exploitation via a malicious document or web page.
Note: This rule is a starting point — tune for your environment. OWC is a legacy component and may not be present on modern systems; presence of these DLLs loading via Office/IE is highly suspicious.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2009-1537
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: SARA Detection Engineering
date: 2026-08-15
tags:
- attack.execution
- attack.t1203
- attack.t1203.002
logsource:
category: image_load
product: windows
detection:
selection_vulnerable_dll:
ImageLoaded|endswith:
- '\OWC10.dll'
- '\OWC11.dll'
selection_host_process:
Image|endswith:
- '\WINWORD.EXE'
- '\EXCEL.EXE'
- '\POWERPNT.EXE'
- '\iexplore.exe'
filter_legitimate_office_components:
Image|endswith:
- '\WINWORD.EXE'
- '\EXCEL.EXE'
- '\POWERPNT.EXE'
ImageLoaded|contains:
- '\Office10\'
- '\Office11\'
condition: selection_vulnerable_dll and selection_host_process and not filter_legitimate_office_components
falsepositives:
- Legacy applications that legitimately rely on Office Web Components for embedded spreadsheet or chart functionality (rare in modern environments).
level: high
Sigma is the open, vendor-neutral format for log-based detections. One rule, written once, converts to Splunk SPL, Elastic ES|QL, KQL for Microsoft Sentinel, Sumo, Chronicle, QRadar, and more. Detection engineers love it for the same reason ATT&CK is the lingua franca for tactics — Sigma is the lingua franca for the queries that detect them.
You've got a fresh write-up of a TTP and need a starting detection in your stack today. Generate, tune, ship.
Pair-program with SARA: the generator produces the skeleton, the engineer learns by tuning, the team commits the result.
You have a rule in one query language; describe it in English and get the Sigma version + conversions to every other backend.
Sketch a detection idea in 30 seconds before investing in a full DE sprint.
SARA Open ships an OpenAI-compatible API. Call POST /api/v1/sigma — Plain English in, valid Sigma YAML out, with MITRE tags and false-positive guidance.
curl -X POST https://sara-open.sirp.io/api/v1/sigma \
-H "Authorization: Bearer $SARA_API_KEY" \
-H "Content-Type: application/json" \
-d '{"description": "PowerShell encoded command from Office"}'
Read the API reference →