CVE-2000-0991

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "OUTLOOK.EXE" or InitiatingProcessFileName =~ "iexplore.exe" or InitiatingProcessFileName =~ "msedge.exe"
| where FileName =~ "hypertrm.exe"
| where ProcessCommandLine contains "telnet://" and ProcessCommandLine has_any ("A{256}", "A{512}") // Example for long URL, adjust length as needed
 or ProcessCommandLine contains ".ht" and ProcessCommandLine has_any ("A{256}", "A{512}") // Example for malformed session file, adjust length as needed

Splunk SPL

(sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventID=1 process_name=hypertrm.exe (parent_process_name=OUTLOOK.EXE OR parent_process_name=iexplore.exe OR parent_process_name=msedge.exe) (CommandLine=*telnet://* AND (CommandLine=*A{256}* OR CommandLine=*A{512}*)) OR (CommandLine=*.ht* AND (CommandLine=*A{256}* OR CommandLine=*A{512}*)))

Sigma

title: HyperTerminal Buffer Overflow Attempt
status: experimental
description: Detects attempts to exploit CVE-2000-0991 via malformed Telnet URLs or session files.
logsource:
  category: process_creation
  product: windows
detection:
  selection_telnet:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\iexplore.exe'
      - '\msedge.exe'
    Image|endswith: '\hypertrm.exe'
    CommandLine|contains:
      - 'telnet://'
      - 'A{256}' # Placeholder for long string, adjust as needed
      - 'A{512}' # Placeholder for long string, adjust as needed
  selection_session_file:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\iexplore.exe'
      - '\msedge.exe'
    Image|endswith: '\hypertrm.exe'
    CommandLine|contains:
      - '.ht'
      - 'A{256}' # Placeholder for long string, adjust as needed
      - 'A{512}' # Placeholder for long string, adjust as needed
  condition: 1 of selection_*
level: high

Elastic ES|QL

from process where event.type == "start" and process.name == "hypertrm.exe" and (process.parent.name == "OUTLOOK.EXE" or process.parent.name == "iexplore.exe" or process.parent.name == "msedge.exe") and (process.args contains "telnet://" and (process.args contains "A{256}" or process.args contains "A{512}")) or (process.args contains ".ht" and (process.args contains "A{256}" or process.args contains "A{512}"))