[Snort-sigs] WinXP remote desktop rules--newbie help

Andreas Östling andreaso at ...58...
Fri Jun 27 00:52:05 EDT 2003


On Thursday 26 June 2003 23.05, John York wrote:
> Does anyone have rules that log WinXP remote desktop sessions starting
> and stopping? 

Perhaps this is still useful:
http://www.geocrawler.com/archives/3/6752/2002/3/50/8170634/

And there is also sid 1447, "MISC MS Terminal server request (RDP)".

/Andreas





More information about the Snort-sigs mailing list