CVE-2015-2469

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName =~ "winword.exe"
| where ProcessCommandLine contains "-o" or ProcessCommandLine contains "/o" or InitiatingProcessCommandLine contains "-o" or InitiatingProcessCommandLine contains "/o"
| where ChildProcessName !in ("consent.exe", "SearchProtocolHost.exe", "SearchFilterHost.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath, SHA256

Splunk SPL

(sourcetype="WinEventLog:Security" EventCode=4688 NewProcessName="*\\winword.exe") OR (sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\winword.exe")
| where like(CommandLine, "% -o %") OR like(CommandLine, "% /o %")
| where NOT (NewProcessName IN ("consent.exe", "SearchProtocolHost.exe", "SearchFilterHost.exe"))
| table _time, Host, ParentProcessName, ProcessName, CommandLine, Hashes

Sigma

title: Microsoft Office Memory Corruption Vulnerability
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious activity related to Microsoft Office memory corruption vulnerabilities, specifically when Word opens a document that might lead to unusual process execution.
references:
  - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\WINWORD.EXE'
    CommandLine|contains:
      - '-o'
      - '/o'
  filter:
    Image|endswith:
      - '\consent.exe'
      - '\SearchProtocolHost.exe'
      - '\SearchFilterHost.exe'
  condition: selection and not filter
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - ParentImage
tags:
  - attack.execution
  - attack.t1204.002
  - cve.2015.2469
level: high

Elastic ES|QL

from process where event.type == "start" and process.parent.executable == "winword.exe" and (process.args : "-o" or process.args : "/o") and not (process.executable : ("consent.exe", "SearchProtocolHost.exe", "SearchFilterHost.exe")) | select @timestamp, host.name, process.parent.executable, process.parent.command_line, process.executable, process.command_line, process.hash.sha256