NF – Polish keyboard layout in RDP connection setup
The rule detects RDP connection setup traffic containing the specific byte sequence "04 15 00 00" in the payload. The presence of this sequence could indicate the use of the Polish keyboard layout during the RDP session setup.
ID Number
5012022
Signature
alert tcp $HOME_NET any -> $EXTERNAL_NET 3389 (msg:"NF - Polish keyboard layout in RDP connection setup"; flow:established; content:"|04 15 00 00|"; nocase; reference:url,networkforensic.dk; metadata:26092014; classtype:misc-activity; sid:5012022; rev:1;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the RDP connection. If the connection is approved - archive and baseline the rule. If not - check the connection and consider blocking the relevant IP address. In case of many False Positives, It’s recommended to disable the rule.