# BlueKeep (CVE-2019-0708) Windows RDP Use-After-Free Exploited In the Wild to Deploy Monero Cryptominer

> CVE-2019-0708 (BlueKeep) is a pre-authentication, wormable use-after-free in the Windows Remote Desktop Services driver (termdd.sys). In early November 2019, Kryptos Logic and Kevin Beaumont confirmed the first in-the-wild exploitation: an opportunistic actor mass-scanned port 3389, fired a Metasploit-derived exploit, and used multi-stage encoded PowerShell to drop a Monero cryptominer onto unpatched Windows hosts. The campaign was unreliable, crashing many systems (BSOD) rather than reliably installing the miner.

- **Published:** 2026-06-11T00:00:00Z
- **Last reviewed:** 2026-06-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0776
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-bluekeep-monero-cryptominer-tl-2026-0776.webp?v=90fad4de (Threadlinqs threat intel: CVE-2019-0708 BlueKeep Windows RDP: Detection & IOCs (TL-2026-0776) — Critical severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-0776
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (2 shown free below)
- **CVEs:** CVE-2019-0708

## Description

BlueKeep (CVE-2019-0708) is a critical use-after-free vulnerability (CWE-416) in the Windows Remote Desktop Services / RDP kernel driver termdd.sys, disclosed and patched by Microsoft on 14 May 2019. The flaw resides in the handling of the MS_T120 internal virtual channel: by binding MS_T120 to a non-default channel number and then triggering its teardown, an unauthenticated attacker frees the channel structure while a dangling pointer to it remains, yielding a use-after-free that can be groomed into remote code execution in kernel context (NT AUTHORITY\SYSTEM). Exploitation requires no authentication and no user interaction over the network (CVSS 3.1 base 9.8; CVSS v2 base 10.0), and because RDP is widely exposed on TCP port 3389, Microsoft, the NSA, and CISA repeatedly warned the bug was 'wormable' and comparable to the SMB flaw behind WannaCry/NotPetya.

Reliable exploitation requires winning a kernel heap grooming race: the freed MS_T120 structure is 0x170 bytes, so working exploits (including the public Metasploit module) heap-spray thousands of 0x170-byte allocations — Kryptos Logic observed 19,000+ identical allocations consistent with heap spraying — to reclaim the freed hole with attacker-controlled data before the dangling pointer is reused. The exploit is notoriously fragile: incorrect grooming corrupts kernel memory and bugchecks the host, which is exactly what defenders observed in the wild.

The in-the-wild campaign was surfaced on 2 November 2019 when Kevin Beaumont's distributed BlueKeep honeypot network ('BluePot') began throwing Blue Screens of Death. Beaumont shared a crash dump with Marcus Hutchins (MalwareTech) at Kryptos Logic, who reverse-engineered it and found BlueKeep exploitation artifacts in kernel memory plus shellcode whose structure matched the Metasploit BlueKeep module. The shellcode used two distinctive signature 'eggs' for its kernel-to-usermode staging: a kernel-mode egg 0x0b00dac0fefe42069 and a usermode egg 0xb00dac0fefe31337. The final-stage shellcode launched an encoded PowerShell command, which in turn downloaded a second-stage PowerShell script from attacker infrastructure that retrieved and executed a Monero (XMR) cryptocurrency miner. The miner sample carried SHA-256 8a87a1261603af4d976faa57e49ebdd8fd8317e9dd13bd36ff2599d1031f53ce (≈44% VirusTotal detection on 3 Nov 2019; an associated sample was first uploaded to VirusTotal on 21 Oct 2019 from a Ukrainian IP). Honeypot crashes were retrospectively traced back to roughly 23 October 2019.

Analysts (Hutchins, Beaumont) assessed the operator as a low-skill, financially motivated actor opportunistically infecting internet-exposed hosts with off-the-shelf penetration-testing tooling rather than a sophisticated or worm-capable adversary — there was no self-propagation, and the exploit's poor reliability limited impact to denial-of-service-style crashes on many targets. The campaign is significant primarily as the proof that a long-feared, six-months-patched, pre-auth wormable RDP bug was finally being weaponized at scale, validating the urgency of the May 2019 emergency patches that even covered end-of-life Windows XP and Server 2003.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1496 Resource Hijacking
- T1499 Endpoint Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BlueKeep Exploitation — RDP/3389 Active Scanning + termdd.sys Bugcheck Correlation** (`TL-2026-0776-SPL-001`)

Detects the exploitation footprint of CVE-2019-0708 (BlueKeep): a burst of inbound connections to TCP 3389 from a single source (active scanning / mass-exploitation of Remote Desktop Services) correlated with clustered Windows bugchecks whose faulting module is termdd.sys. Unreliable BlueKeep exploitation frequently corrupts kernel memory and bugchecks (BSOD) the target, so termdd.sys crashes on internet-exposed RDP hosts shortly after a scan spike are a high-fidelity exploitation indicator.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.002, T1046, T1499
- **Data sources:** firewall, windows_security, sysmon, wineventlog_system, edr_network
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=network sourcetype=firewall OR sourcetype="pan:traffic" dest_port=3389 action=allowed) OR (index=wineventlog sourcetype="WinEventLog:System" SourceName="Microsoft-Windows-WER-SystemErrorReporting" "termdd.sys")
| eval rdp_scan=if(dest_port=3389,1,0)
| eval termdd_crash=if(searchmatch("termdd.sys"),1,0)
| bin _time span=5m
| stats dc(src_ip) AS distinct_sources sum(rdp_scan) AS rdp_conn_count sum(termdd_crash) AS termdd_bugchecks values(src_ip) AS src_ips BY _time dest_ip
| where rdp_conn_count>100 OR termdd_bugchecks>0
| eval risk=case(termdd_bugchecks>0 AND rdp_conn_count>100,"critical: scan spike + termdd bugcheck",termdd_bugchecks>0,"high: termdd.sys bugcheck on RDP host",true(),"medium: RDP scan spike")
| table _time dest_ip distinct_sources rdp_conn_count termdd_bugchecks src_ips risk
```

### Microsoft KQL

```kql
let scan = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 3389 and ActionType == "InboundConnectionAccepted"
| summarize RdpConn = count(), Sources = dcount(RemoteIP) by DeviceId, bin(Timestamp, 5m)
| where RdpConn > 100;
let crash = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("BugCheck", "SystemCrash") or AdditionalFields has "termdd.sys"
| summarize Bugchecks = count() by DeviceId, bin(Timestamp, 5m);
scan | join kind=fullouter crash on DeviceId
| project Timestamp = coalesce(Timestamp, Timestamp1), DeviceId = coalesce(DeviceId, DeviceId1), RdpConn, Sources, Bugchecks
| where RdpConn > 100 or Bugchecks > 0
```

### Sigma

```yaml
title: BlueKeep Exploitation - RDP Scan Spike and termdd.sys Bugcheck
id: 6a1f2c84-7e3b-4d09-9b21-0708bluekeep01
status: experimental
description: Correlates high-volume inbound TCP 3389 connections with termdd.sys bugchecks indicative of CVE-2019-0708 (BlueKeep) exploitation attempts
references:
    - https://www.kryptoslogic.com/blog/2019/11/bluekeep-cve-2019-0708-exploitation-spotted-in-the-wild/
    - https://nvd.nist.gov/vuln/detail/CVE-2019-0708
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/11
tags:
    - attack.initial_access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
    - attack.impact
    - attack.t1499
    - cve.2019.0708
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
        Data|contains: 'termdd.sys'
    condition: selection
falsepositives:
    - Genuine termdd.sys driver faults from unrelated RDP stability bugs or buggy third-party RDP add-ons
level: high
```

**Known false positives:**

- Legitimate RDP gateway / load-balancer health checks generating many 3389 connections
- Genuine termdd.sys faults unrelated to BlueKeep (driver bugs, unstable RDP add-ons)
- Authorized vulnerability scanners sweeping RDP from a known source IP

**Tuning notes:** Tune the 100-connections-per-5min threshold to your environment's baseline RDP volume; allowlist authorized scanner and RDP-gateway source IPs. Raise severity when a termdd.sys bugcheck immediately follows a scan spike from the same external source.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BlueKeep Exploitation — [indicator] Bugcheck / BSOD on Internet-Exposed RDP Host (locked: unlock with TL Creds)
- BlueKeep Post-Exploitation — RDP-Service-Spawned Encoded PowerShell (Defender) (locked: unlock with TL Creds)
- BlueKeep C2 — PowerShell Outbound Download Followed by Monero Miner Behavior (locked: unlock with TL Creds)
- BlueKeep Exploitation — Shellcode Signature Eggs + 0x170 Heap-Spray in Memory (locked: unlock with TL Creds)
- BlueKeep Post-Exploitation — Decoded Stager: Encoded PowerShell with Hidden/NoProfile Flags (locked: unlock with TL Creds)
- BlueKeep Impact — Monero Miner Ingress Transfer + Run-Key Persistence (Resource Hijacking) (locked: unlock with TL Creds)
- BlueKeep Post-Exploitation — Encoded PowerShell Stager from RDP Service Context (locked: unlock with TL Creds)
- BlueKeep C2 / Ingress Tool Transfer — PowerShell HTTP Download + Monero Miner Drop (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 16)

Defanged, TLP:CLEAR.

- Domain: `termdd[.]sys`
- File hash: `8a87a1261603af4d976faa57e49ebdd8fd8317e9dd13bd36ff2599d1031f53ce`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BlueKeep (CVE-2019-0708) Exploitation Spotted in the Wild](https://www.kryptoslogic.com/blog/2019/11/bluekeep-cve-2019-0708-exploitation-spotted-in-the-wild/)
- [CVE-2019-0708: BlueKeep Exploited in the Wild to Deliver Cryptocurrency Miner](https://www.tenable.com/blog/cve-2019-0708-bluekeep-exploited-in-the-wild-to-deliver-cryptocurrency-miner)
- [NVD - CVE-2019-0708](https://nvd.nist.gov/vuln/detail/CVE-2019-0708)
- [Microsoft Security Advisory CVE-2019-0708 (Remote Desktop Services RCE)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-0708)
- [BlueKeep Attacks Arrive, Bearing Cryptomining Malware](https://www.bankinfosecurity.com/new-bluekeep-attacks-drop-cryptominer-malware-a-13341)
- [Attackers attempt large-scale BlueKeep exploit to spread cryptominer (SC Media)](https://www.scworld.com/news/attackers-attempt-large-scale-bluekeep-exploit-to-spread-cryptominer)
- [BlueKeep - Wikipedia (timeline of events)](https://en.wikipedia.org/wiki/BlueKeep)
- [BlueKeep Scanner Discovered in Watchbog Cryptomining Malware](https://www.bleepingcomputer.com/news/security/bluekeep-scanner-discovered-in-watchbog-cryptomining-malware/)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2019-0708](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0776