CVE-2000-0929

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in ("OUTLOOK.EXE", "MIMESET.EXE")
| where ProcessCommandLine contains ".ocx" and ProcessCommandLine contains "Windows Media Player 7"
| summarize count() by DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| where count_ > 5 // Adjust threshold as needed for abnormal activity

Splunk SPL

index=windows (process_name="outlook.exe" OR process_name="mimeset.exe") (command_line="*.ocx*" AND command_line="*Windows Media Player 7*")
| stats count by host, process_name, command_line, parent_process_name
| where count > 5

Sigma

title: Windows Media Player 7 OCX DoS Attempt
status: experimental
description: Detects potential attempts to exploit CVE-2000-0929 by monitoring email client processes interacting with WMP7 OCX controls.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\outlook.exe'
      - '\mimeset.exe'
    CommandLine|contains:
      - '.ocx'
      - 'Windows Media Player 7'
  condition: selection
fields:
  - Image
  - CommandLine
level: medium

Elastic ES|QL

from process where process.name in ("outlook.exe", "mimeset.exe") and process.command_line : ("*.ocx", "*Windows Media Player 7*")
| stats count() by host.name, process.name, process.command_line, process.parent.name
| where count > 5