Scanner PoC for CVE-2019-0708 RDP RCE Vuln

Title: Scanner PoC for CVE-2019-0708 RDP RCE Vuln
Status: test
Description:Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to CVE-2019-0708 RDP RCE aka BlueKeep
References:
  -https://twitter.com/AdamTheAnalyst/status/1134394070045003776
  -https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
Author: Florian Roth (Nextron Systems), Adam Bradbury (idea)
Date: 2019-06-02
modified:2022-12-25
Tags:

• -'attack.lateral-movement'
• -'attack.t1210'
• -'car.2013-07-002'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4625'
    TargetUserName: 'AAAAAAA'
  condition:selection
Falsepositives:
  -Unlikely
Level: high