alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO RealThinClient Outbound Communication"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/$rdgate?ACTION="; depth:16; fast_pattern; http.header; content:"HOST|3a|"; nocase; http.header_names; content:!"Accept"; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; reference:md5,e6fe6b5f943a45018d2d0da4357cfe6d; reference:url,rtc.teppi.net; classtype:bad-unknown; sid:2036704; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_09_24, deployment Perimeter, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_09;)