""ET POLICY Tunneled RDP Handshake""

SID: 2027193

Revision: 1

Class Type: bad-unknown

Metadata: affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Perimeter, signature_severity Minor, updated_at 2019_04_11

Reference:

Protocol: tcp

Source Network: any

Source Port: [21,22,23,25,53,80,443,8080]

Destination Network: any

Destination Port: !3389

Flow: established

Contents:

  • Value: "|c0 00|Duca" Depth: 250

  • Value: "rdpdr"

  • Value: "cliprdr"

Within:

PCRE:

Special Options:

source