alert tcp any any -> any any (msg:"TOOLS [PTsecurity] Possible xfreerdp RDP client"; flow:established, to_server, no_stream; content:"|03 00|"; depth:2; content:"Duca"; distance:0; content:"|01 C0|"; distance:2; within:2; byte_jump:2, 0, relative, little, post_offset -4; content:"|04 C0|"; within:2; byte_jump:2, 0, relative, little, post_offset -4; content:"|02 C0|"; within:2; isdataat:!11, relative; reference:url, github.com/ptresearch/AttackDetection; classtype:bad-unknown; sid:10005928; rev:2;)