diff --git a/testing/btest/Baseline/scripts.base.protocols.rdp.rdp-unknown-keyboard/rdp.log b/testing/btest/Baseline/scripts.base.protocols.rdp.rdp-unknown-keyboard/rdp.log
new file mode 100644
index 0000000000..37dd9625da
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.rdp.rdp-unknown-keyboard/rdp.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	rdp
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	cookie	result	security_protocol	client_channels	keyboard_layout	client_build	client_name	client_dig_product_id	desktop_width	desktop_height	requested_color_depth	cert_type	cert_count	cert_permanent	encryption_level	encryption_method
+#types	time	string	addr	port	addr	port	string	string	string	vector[string]	string	string	string	string	count	count	string	string	count	bool	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.1.1	54990	192.168.1.2	3389	JOHN-PC  	-	RDP	rdpdr,rdpsnd,cliprdr,drdynvc	Thai (Best Guess for 263198)	RDP 8.1	JOHN-PC-LAPTOP	3c571ed0-3415-474b-ae94-74e151b	1920	1080	16bit	-	0	-	-	-
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Traces/rdp/rdp-unknown-keyboard.pcap b/testing/btest/Traces/rdp/rdp-unknown-keyboard.pcap
new file mode 100644
index 0000000000..d2497f26a1
Binary files /dev/null and b/testing/btest/Traces/rdp/rdp-unknown-keyboard.pcap differ
diff --git a/testing/btest/scripts/base/protocols/rdp/rdp-unknown-keyboard.zeek b/testing/btest/scripts/base/protocols/rdp/rdp-unknown-keyboard.zeek
new file mode 100644
index 0000000000..cdcc267e06
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/rdp/rdp-unknown-keyboard.zeek
@@ -0,0 +1,8 @@
+# Tests the keyboard_layout code in the RDP protocol for handling
+# keyboards script-layer doesn't know about, and the fallback
+# to looking for best guesses.
+
+# @TEST-EXEC: zeek -C -b -r $TRACES/rdp/rdp-unknown-keyboard.pcap %INPUT
+# @TEST-EXEC: btest-diff rdp.log
+
+@load base/protocols/rdp
\ No newline at end of file