Windows System Log RDP TermDD Errors Matching EventIDs 50 or 56

Flags suspicious TermDD RDP error events (Event IDs 50/56) on Windows that may indicate CVE-2019-0708 activity.

FreeReviewedSigma · Medium · v5

Product: windows
Service: system
Author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements) (SigmaHQ), DRL 1.1
Published: 2019-05-24
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1210Exploitation of Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows System events from the TermDD provider where EventID is 50 or 56, indicating suspicious or unsuccessful Remote Desktop Protocol activity. Attackers may trigger these errors during RDP exploitation attempts or other lateral movement workflows, making repeated or abnormal TermDD failures a useful signal for investigation. Detection relies on Windows System log telemetry containing TermDD Provider_Name and the specified EventIDs.

Reporting behind it

Related detections9 linkedT1210 — drag to rearrange

Possible .NET Remoting Deserialisation Exploitation via REM Endpoint

Possible xrdp RCE Exploitation via ts_info_utf16_in Buffer Overflow (via application)

Malicious WannaCry tasksche Execution from mssecsvc Service via process_creation

Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com

Potential CVE-2023-46214 RCE Attempt via Insecure XML in Splunk Enterprise (Webserver HTTP POST)

Splunk Enterprise RCE Exploitation Attempt via XML Upload and Search Job Requests

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Suspicious SysAidServer Child Processes via Java on Windows

Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe

Windows System Log RDP TermDD Errors Matching EventIDs 50 or 56

Pivot detection · T1210 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-rdp-termdd-error-events-indicating-possible-cve-2019-0708-exploitation-aaa5b30d

title: Windows System Log RDP TermDD Errors Matching EventIDs 50 or 56
id: 60daa0e1-55f3-4c48-90e1-bd9fc7e70ae3
status: test
description: This rule flags Windows System events from the TermDD provider where EventID is 50 or 56, indicating suspicious or unsuccessful Remote Desktop Protocol activity. Attackers may trigger these errors during RDP exploitation attempts or other lateral movement workflows, making repeated or abnormal TermDD failures a useful signal for investigation. Detection relies on Windows System log telemetry containing TermDD Provider_Name and the specified EventIDs.
references:
  - https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
  - https://github.com/Ekultek/BlueKeep
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_system_exploit_cve_2019_0708.yml
author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements), Huntrule Team
date: 2019-05-24
modified: 2022-12-25
tags:
  - attack.lateral-movement
  - attack.t1210
  - car.2013-07-002
  - cve.2019-0708
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID:
      - 56
      - 50
    Provider_Name: TermDD
  condition: selection
falsepositives:
  - Bad connections or network interruptions
level: medium
license: DRL-1.1
related:
  - id: aaa5b30d-f418-420b-83a0-299cb6024885
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL