Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add RDP over UDP analyzer

Browse source
This commit is contained in:
Anthony Kasza 2020-03-22 14:43:54 -06:00 • committed by Jon Siwek
parent c42ebfa1cf
commit 60644bc85f
15 changed files with 512 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

9
scripts/base/protocols/rdp/dpd.sig
View file

@ -10,3 +10,12 @@ signature dpd_rdp_server {
ip-proto == tcp
payload /(.{5}\xd0|.*McDn)/
}
signature dpd_rdpeudp_syn {
ip-proto == udp
payload-size <= 1232
payload-size >= 1132
payload /^\xff{4}.{2}.{1}\x01/
enable "rdpeudp"
}