Windows RDP TermDD Error Events Indicating Possible CVE-2019-0708 Exploitation

Flags suspicious TermDD RDP error events (Event IDs 50/56) on Windows that may indicate CVE-2019-0708 activity.

FreeUnreviewedSigmamediumv1

windows-rdp-termdd-error-events-indicating-possible-cve-2019-0708-exploitation-aaa5b30d

title: Windows RDP TermDD Error Events Indicating Possible CVE-2019-0708 Exploitation
id: 60daa0e1-55f3-4c48-90e1-bd9fc7e70ae3
status: test
description: This rule flags Windows System events from the TermDD provider with Event IDs 50 or 56, which indicate suspicious RDP-related errors tied to potential exploitation of CVE-2019-0708. Attackers may trigger these error conditions when attempting RDP session negotiation or triggering vulnerable behavior during lateral movement. Detection relies on Windows System telemetry capturing the specific TermDD provider and the corresponding event identifiers, while network interruptions can cause similar errors.
references:
  - https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
  - https://github.com/Ekultek/BlueKeep
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_system_exploit_cve_2019_0708.yml
author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements), Huntrule Team
date: 2019-05-24
modified: 2022-12-25
tags:
  - attack.lateral-movement
  - attack.t1210
  - car.2013-07-002
  - cve.2019-0708
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID:
      - 56
      - 50
    Provider_Name: TermDD
  condition: selection
falsepositives:
  - Bad connections or network interruptions
level: medium
license: DRL-1.1
related:
  - id: aaa5b30d-f418-420b-83a0-299cb6024885
    type: derived

What it detects

This rule flags Windows System events from the TermDD provider with Event IDs 50 or 56, which indicate suspicious RDP-related errors tied to potential exploitation of CVE-2019-0708. Attackers may trigger these error conditions when attempting RDP session negotiation or triggering vulnerable behavior during lateral movement. Detection relies on Windows System telemetry capturing the specific TermDD provider and the corresponding event identifiers, while network interruptions can cause similar errors.

Known false positives

Bad connections or network interruptions

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.