Detection rules › By event

Microsoft-Windows-RemoteDesktopServices-RdpCoreTS

Event	Rules
Event ID 131	1
Event ID 148	1

Event ID 131

1 detection rules reference this event. View event page.

Sigma (1)

RDP discovery performed on multiple hosts severity high T1021, T1021.001, T1046, T1110

Event ID 148

1 detection rules reference this event. View event page.

Sigma (1)

RDP BlueeKeep connection closed (CVE-2019-0708) severity high T1021, T1021.001