alert tcp any any -> any any (msg:"🐾 - 🚨 RDP Connection 🦸 Administrateur Account"; flow:to_server, stateless; content:"cookie"; nocase; content:"mstshash"; nocase; content:"administrateur"; fast_pattern; nocase; metadata:created_at 2021_05_15, updated_at 2022_11_13; sid:3300133; rev:8; classtype:policy-violation;)