[Snort-sigs] WinXP remote desktop rules--newbie help

Andreas Östling andreaso at ...58...
Fri Jun 27 00:52:05 EDT 2003

On Thursday 26 June 2003 23.05, John York wrote:
> Does anyone have rules that log WinXP remote desktop sessions starting
> and stopping? 

Perhaps this is still useful:

And there is also sid 1447, "MISC MS Terminal server request (RDP)".


More information about the Snort-sigs mailing list