Scanner PoC for CVE-2019-0708 RDP RCE Vulnerability (BlueKeep)

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•2•0•33

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE, also known as BlueKeep. The detection specifically looks for failed RDP login attempts (EventID 4625) with a TargetUserName of 'AAAAAAA', which is a known signature of this scanner.