mirror of
https://github.com/zeek/zeek.git
synced 2025-10-08 01:28:20 +00:00
17 lines
322 B
Standard ML
17 lines
322 B
Standard ML
signature dpd_rdp_client_request {
|
|
ip-proto == tcp
|
|
payload /.*Cookie: mstshash\=.*/
|
|
enable "rdp"
|
|
}
|
|
|
|
signature dpd_rdp_client_header {
|
|
ip-proto == tcp
|
|
payload /.*Duca.*(rdpdr|rdpsnd|drdynvc|cliprdr).*/
|
|
enable "rdp"
|
|
}
|
|
|
|
signature dpd_rdp_server_response {
|
|
ip-proto == tcp
|
|
payload /.*McDn.*/
|
|
enable "rdp"
|
|
}
|