Detection rules › By catalog entry

Microsoft-Windows-RemoteDesktopServices-RdpCoreTS

Catalog entry	Rules
Event ID 131	1
Event ID 148	1

Event ID 131

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

RDP discovery performed on multiple hosts severity high T1021,T1021.001,T1046,T1110

Event ID 148

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

RDP BlueeKeep connection closed (CVE-2019-0708) severity high T1021,T1021.001

Back to all Microsoft-Windows-RemoteDesktopServices-RdpCoreTS catalog entries