Managed Service Provider RDP Session Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects RDP (Remote Desktop Protocol) sessions initiated towards the HOME_NET on port 3389. It specifically looks for the RDP connection initiation sequence (content:"|03 00|" with depth:2) and uses a threshold to detect multiple connections from the same source within a 5-minute window, which could indicate activity from a Managed Service Provider or other remote access scenarios.