Terminal Service Process Spawn (CVE-2019-0708 BlueKeep)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

Detects a process spawned by the terminal service server process (termsvcs), which could indicate an exploitation attempt of CVE-2019-0708, commonly known as BlueKeep. The rule specifically looks for processes where the parent command line contains both 'svchost.exe' and 'termsvcs', while filtering out legitimate processes like rdpclip.exe, csrss.exe, wininit.exe, and winlogon.exe.