Potential RDP Exploit CVE-2019-0708 (BlueKeep)

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•1•0•26

This rule detects suspicious errors related to the Remote Desktop Protocol (RDP) that could indicate an attempt to exploit CVE-2019-0708, also known as BlueKeep. It specifically looks for Event IDs 56 or 50 generated by the 'TermDD' provider, which are associated with RDP session errors that can occur during exploitation attempts.