RDP Session Hijacking from Internal Host

Darshan Thummar@Mighty

•updated Jun 12, 2026•11•1•8

This rule detects potential RDP session hijacking attempts originating from an internal host. It specifically looks for TCP traffic destined for port 3389 (RDP) on the home network, with a specific content signature "|03 00|" at the beginning of the payload. A threshold of 3 connections within 10 seconds from the same destination is set to reduce false positives.