Great question Kamran. When dealing with ActiveX vulnerabilities/exploits, as stated in the referenced document,
"When vulnerabilities are found in ActiveX controls, the vendor typically discloses the specific vulnerable ActiveX CLSID or ProgID values. If these details are provided, the use of regular expressions can be employed within the application layer protocol inspection engine to identify specific strings in a packet and perform specific actions on this traffic as defined by the inspection policy."
That said, in the event that the vendor has not provided the CLSID or ProgID values in clear manner it often takes a simple google search to locate them. A prime example of this is the fact that more often than not the vendor provides one of these details or the other (most often the CLSID), thus a quick search will reveal the ProgID, especially on the disclosed vulnerabilities.
For example, if one were to deal with an Adobe Shockwave activeX vulnerability or exploit, you could do a quick google search and discover the ProgID info from one of the first hits (http://forums.adobe.com/thread/876552):
progid:ShockwaveFlash.ShockwaveFlash.
The ProgID and CLSID info are generally not kept secret, they are public knowledge. You will find that as you deal with these types of exploits more and more, you will be able to pick up/discover the requisite CLSID and ProgID quite quickly.
Hope this helps!
-Andrae
