iSID Analyst Knowledge Base

Definitions, and additional context on iSID alerts along with helpful recommendations

NF – Indonesian keyboard layout in RDP connection setup

The rule detects RDP connection setup traffic containing the specific byte sequence "04 21 00 00" in the payload. The presence of this sequence could indicate the use of the Indonesian keyboard layout during the RDP session setup.

NF – Hungarian keyboard layout in RDP connection setup

The rule detects RDP connection setup traffic containing the specific byte sequence "04 0e 00 00" in the payload. The presence of this sequence could indicate the use of the Hungarian keyboard layout during the RDP session setup.

NF – Greek keyboard layout in RDP connection setup

The rule detects RDP connection setup traffic containing the specific byte sequence "04 08 00 00" in the payload. The presence of this sequence could indicate the use of the Greek keyboard layout during the RDP session setup.

NF – German_Standard keyboard layout in RDP connection setup

The rule detects RDP connection setup traffic containing the specific byte sequence "04 07 00 00" in the payload. The presence of this sequence could indicate the use of the German keyboard layout during the RDP session setup.

NF – Georgian keyboard layout in RDP connection setup

The rule detects RDP connection setup traffic containing the specific byte sequence "04 37 00 00" in the payload. The presence of this sequence could indicate the use of the Georgian keyboard layout during the RDP session setup.