""ET SCAN MS Terminal Server Traffic on Non-standard Port""
SID: 2023753
Revision: 3
Class Type: attempted-recon
Metadata: affected_product Microsoft_Terminal_Server_RDP, attack_target Server, created_at 2017_01_23, deployment Perimeter, performance_impact Moderate, signature_severity Major, updated_at 2022_09_14
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HOME_NET
Destination Port: !3389
Flow: to_server,established
Contents:
-
Value: "|03 00 00|" Depth: 3
-
Value: "|e0 00 00 00 00 00|" Depth: 6 Offset: 5
-
Value: "Cookie|3a 20|mstshash="
Within:
PCRE:
Special Options:
- fast_pattern