Add rule for CVE-2019-0708

rules/windows/builtin/win_rdp_potential_cve-2019-0708.yml

@@ -0,0 +1,20 @@
+title: Potential RDP exploit CVE-2019-0708
+description: Detect suspicious error on protocol RDP, potential CVE-2019-0708
+references:
+    - https://github.com/zerosum0x0/CVE-2019-0708
+tags:
+    - attack.initial_access
+status: experimental
+author: Lionel PRAT, Christophe BROCAS
+logsource:
+    product: windows
+    service: system
+detection:
+    selection:
+        EventID: 56
+        Source: TermDD
+    condition: selection
+falsepositives:
+    - Unknown
+level: critical
+