alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - RDP negociation request to Internet 🌐"; flow:to_server, stateless; flowbits:set,pptrls.rdpexter; flowbits:isnotset,pptrls.rdpexter; content:"|03 00|"; startswith; content:"|01|"; content:"|08 00|"; distance:1; content:"|00 00 00|"; distance:1; dsize:<60; metadata:created_at 2024_11_01, updated_at 2024_11_05; sid:3321394; rev:2; classtype:not-suspicious; noalert;)