[Snort-users] Terminal services signature

McCammon, Keith Keith.McCammon at ...3497...
Wed Jul 24 12:31:17 EDT 2002


> How do I create a rule to alert terminal service access
> 
> Alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"Terminal Services
> access"; ......
> 
> 
> ... Then I don't know what to put in between ()

Just add a closing parenthesis and you're good to go.




More information about the Snort-users mailing list