BlueKeep RDP Pre-Auth RCE Exploit Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects an attempted pre-authentication Remote Code Execution (RCE) exploit against the Remote Desktop Protocol (RDP) service, commonly known as 'BlueKeep'. It specifically looks for a sequence of bytes within the RDP traffic on port 3389, indicating a potential exploit attempt.