The rule detects RDP connection setup traffic containing the specific byte sequence "04 21 00 00" in the payload. The presence of this sequence could indicate the use of the Indonesian keyboard layout during the RDP session setup.
The rule detects RDP connection setup traffic containing the specific byte sequence "04 0e 00 00" in the payload. The presence of this sequence could indicate the use of the Hungarian keyboard layout during the RDP session setup.
The rule detects RDP connection setup traffic containing the specific byte sequence "04 08 00 00" in the payload. The presence of this sequence could indicate the use of the Greek keyboard layout during the RDP session setup.
The rule detects RDP connection setup traffic containing the specific byte sequence "04 07 00 00" in the payload. The presence of this sequence could indicate the use of the German keyboard layout during the RDP session setup.
The rule detects RDP connection setup traffic containing the specific byte sequence "04 37 00 00" in the payload. The presence of this sequence could indicate the use of the Georgian keyboard layout during the RDP session setup.