Windows Security Log: Detects 4625 RDP failure pattern from scanner PoC for BlueKeep (CVE-2019-0708)

title: "Windows Security Log: Detects 4625 RDP failure pattern from scanner PoC for BlueKeep (CVE-2019-0708)"
id: d499b1d8-0329-47e3-bacb-71a6739fb3f4
status: test
description: This rule flags Windows Security events (EventID 4625) with a specific TargetUserName value that match activity consistent with a scanner proof of concept for the BlueKeep RDP RCE vulnerability (CVE-2019-0708). Failed logons are a common reconnaissance signal as attackers probe RDP exposure before attempting exploitation. It relies on Windows Security auditing telemetry, specifically the presence of EventID 4625 and the TargetUserName field value.
references:
  - https://twitter.com/AdamTheAnalyst/status/1134394070045003776
  - https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-0708/win_security_exploit_cve_2019_0708_scanner_poc.yml
author: Florian Roth (Nextron Systems), Adam Bradbury (idea), Huntrule Team
date: 2019-06-02
modified: 2022-12-25
tags:
  - attack.lateral-movement
  - attack.t1210
  - car.2013-07-002
  - detection.emerging-threats
  - cve.2019-0708
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    TargetUserName: AAAAAAA
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 8400629e-79a9-4737-b387-5db940ab2367
    type: derived