huntrule

Windows System Log RDP TermDD Errors Matching EventIDs 50 or 56

Flags suspicious TermDD RDP error events (Event IDs 50/56) on Windows that may indicate CVE-2019-0708 activity.

FreeReviewedSigma · Medium · v5
Product
windows
Service
system
Author
Lionel PRAT, Christophe BROCAS, @atc_project (improvements) (SigmaHQ), DRL 1.1
Published
2019-05-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows System events from the TermDD provider where EventID is 50 or 56, indicating suspicious or unsuccessful Remote Desktop Protocol activity. Attackers may trigger these errors during RDP exploitation attempts or other lateral movement workflows, making repeated or abnormal TermDD failures a useful signal for investigation. Detection relies on Windows System log telemetry containing TermDD Provider_Name and the specified EventIDs.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange
Possible .NET Remoting Deserialisation Exploitation via REM Endpoint
Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)
Malicious WannaCry tasksche Execution from mssecsvc Service via process_creation
Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)
Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests
Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters
Suspicious SysAidServer Child Processes via Java on Windows
Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe
Windows System Log RDP TermDD Errors Matching EventIDs 50 or 56
Pivot detection · T1210 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.