alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with bg Keyboard Layout (win)"; flow:to_server,established; content:"|02 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690001; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with bg Keyboard Layout (Remmina)"; flow:to_server,established; content:"|02 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690002; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with bg Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|02 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690003; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ch Keyboard Layout (win)"; flow:to_server,established; content:"|04 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690004; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ch Keyboard Layout (Remmina)"; flow:to_server,established; content:"|04 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690005; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ch Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|04 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690006; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cz Keyboard Layout (win)"; flow:to_server,established; content:"|05 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690007; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cz Keyboard Layout (Remmina)"; flow:to_server,established; content:"|05 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690008; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cz Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|05 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690009; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with dk Keyboard Layout (win)"; flow:to_server,established; content:"|06 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690010; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with dk Keyboard Layout (Remmina)"; flow:to_server,established; content:"|06 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690011; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with dk Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|06 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690012; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gr Keyboard Layout (win)"; flow:to_server,established; content:"|07 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690013; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gr Keyboard Layout (Remmina)"; flow:to_server,established; content:"|07 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690014; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gr Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|07 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690015; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (win)"; flow:to_server,established; content:"|08 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690016; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (Remmina)"; flow:to_server,established; content:"|08 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690017; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|08 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690018; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|09 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690019; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690020; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690021; rev:3;) #alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ESP Keyboard Layout (win)"; flow:to_server,established; content:"|0A 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690022; rev:3;) #alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ESP Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0A 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690023; rev:3;) #alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ESP Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0A 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690024; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with su Keyboard Layout (win)"; flow:to_server,established; content:"|0B 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690025; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with su Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0B 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690026; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with su Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0B 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690027; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with fr Keyboard Layout (win)"; flow:to_server,established; content:"|40 00 00 C0|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690028; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with fr Keyboard Layout (Remmina)"; flow:to_server,established; content:"|40 00 00 C0|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690029; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with fr Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|40 00 00 C0|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690030; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with hu Keyboard Layout (win)"; flow:to_server,established; content:"|0E 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690031; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with hu Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0E 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690032; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with hu Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0E 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690033; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with es Keyboard Layout (win)"; flow:to_server,established; content:"|0F 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690034; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with es Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0F 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690035; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with es Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0F 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690036; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with it Keyboard Layout (win)"; flow:to_server,established; content:"|10 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690037; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with it Keyboard Layout (Remmina)"; flow:to_server,established; content:"|10 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690038; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with it Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|10 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690039; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with jp Keyboard Layout (win)"; flow:to_server,established; content:"|11 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690040; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with jp Keyboard Layout (Remmina)"; flow:to_server,established; content:"|11 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690041; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with jp Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|11 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690042; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ko Keyboard Layout (win)"; flow:to_server,established; content:"|12 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690043; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ko Keyboard Layout (Remmina)"; flow:to_server,established; content:"|12 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690044; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ko Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|12 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690045; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with nl Keyboard Layout (win)"; flow:to_server,established; content:"|13 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690046; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with nl Keyboard Layout (Remmina)"; flow:to_server,established; content:"|13 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690047; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with nl Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|13 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690048; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with no Keyboard Layout (win)"; flow:to_server,established; content:"|14 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690049; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with no Keyboard Layout (Remmina)"; flow:to_server,established; content:"|14 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690050; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with no Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|14 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690051; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with pl Keyboard Layout (win)"; flow:to_server,established; content:"|15 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690052; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with pl Keyboard Layout (Remmina)"; flow:to_server,established; content:"|15 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690053; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with pl Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|15 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690054; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with br Keyboard Layout (win)"; flow:to_server,established; content:"|16 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690055; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with br Keyboard Layout (Remmina)"; flow:to_server,established; content:"|16 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690056; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with br Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|16 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690057; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ro Keyboard Layout (win)"; flow:to_server,established; content:"|18 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690058; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ro Keyboard Layout (Remmina)"; flow:to_server,established; content:"|18 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690059; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ro Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|18 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690060; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ru Keyboard Layout (win)"; flow:to_server,established; content:"|19 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690061; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ru Keyboard Layout (Remmina)"; flow:to_server,established; content:"|19 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690062; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ru Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|19 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690063; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with yu Keyboard Layout (win)"; flow:to_server,established; content:"|1A 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690064; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with yu Keyboard Layout (Remmina)"; flow:to_server,established; content:"|1A 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690065; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with yu Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|1A 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690066; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sl Keyboard Layout (win)"; flow:to_server,established; content:"|1B 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690067; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sl Keyboard Layout (Remmina)"; flow:to_server,established; content:"|1B 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690068; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sl Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|1B 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690069; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|41 00 00 C0|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690070; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|41 00 00 C0|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690071; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|41 00 00 C0|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690072; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with VP Keyboard Layout (win)"; flow:to_server,established; content:"|41 00 00 D0|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690073; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with VP Keyboard Layout (Remmina)"; flow:to_server,established; content:"|41 00 00 D0|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690074; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with VP Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|41 00 00 D0|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690075; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with tr Keyboard Layout (win)"; flow:to_server,established; content:"|1F 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690076; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with tr Keyboard Layout (Remmina)"; flow:to_server,established; content:"|1F 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690077; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with tr Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|1F 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690078; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|22 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690079; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|22 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690080; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|22 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690081; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|23 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690082; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|23 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690083; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|23 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690084; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with yu Keyboard Layout (win)"; flow:to_server,established; content:"|24 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690085; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with yu Keyboard Layout (Remmina)"; flow:to_server,established; content:"|24 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690086; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with yu Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|24 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690087; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with et Keyboard Layout (win)"; flow:to_server,established; content:"|25 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690088; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with et Keyboard Layout (Remmina)"; flow:to_server,established; content:"|25 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690089; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with et Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|25 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690090; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|26 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690091; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|26 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690092; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|26 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690093; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|27 04 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690094; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|27 04 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690095; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|27 04 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690096; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ch Keyboard Layout (win)"; flow:to_server,established; content:"|04 08 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690097; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ch Keyboard Layout (Remmina)"; flow:to_server,established; content:"|04 08 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690098; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ch Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|04 08 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690099; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sg Keyboard Layout (win)"; flow:to_server,established; content:"|07 08 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690100; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sg Keyboard Layout (Remmina)"; flow:to_server,established; content:"|07 08 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690101; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sg Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|07 08 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690102; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with uk Keyboard Layout (win)"; flow:to_server,established; content:"|09 08 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690103; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with uk Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 08 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690104; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with uk Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 08 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690105; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with la Keyboard Layout (win)"; flow:to_server,established; content:"|0A 08 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690106; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with la Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0A 08 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690107; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with la Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0A 08 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690108; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ser Keyboard Layout (win)"; flow:to_server,established; content:"|80 00 00 C0|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690109; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ser Keyboard Layout (Remmina)"; flow:to_server,established; content:"|80 00 00 C0|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690110; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ser Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|80 00 00 C0|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690111; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ser Keyboard Layout (win)"; flow:to_server,established; content:"|13 08 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690112; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ser Keyboard Layout (Remmina)"; flow:to_server,established; content:"|13 08 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690113; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ser Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|13 08 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690114; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with po Keyboard Layout (win)"; flow:to_server,established; content:"|16 08 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690115; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with po Keyboard Layout (Remmina)"; flow:to_server,established; content:"|16 08 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690116; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with po Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|16 08 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690117; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cf Keyboard Layout (win)"; flow:to_server,established; content:"|0C 0C 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690118; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cf Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0C 0C 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690119; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cf Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0C 0C 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690120; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|1A 0C 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690121; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|1A 0C 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690122; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|1A 0C 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690123; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|09 10 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690124; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 10 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690125; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 10 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690126; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with CF Keyboard Layout (win)"; flow:to_server,established; content:"|00 01 00 C0|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690127; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with CF Keyboard Layout (Remmina)"; flow:to_server,established; content:"|00 01 00 C0|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690128; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with CF Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|00 01 00 C0|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690129; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|09 18 00 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690130; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 18 00 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690131; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 18 00 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690132; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|02 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690133; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|02 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690134; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|02 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690135; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cz Keyboard Layout (win)"; flow:to_server,established; content:"|05 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690136; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cz Keyboard Layout (Remmina)"; flow:to_server,established; content:"|05 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690137; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cz Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|05 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690138; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gr Keyboard Layout (win)"; flow:to_server,established; content:"|07 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690139; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gr Keyboard Layout (Remmina)"; flow:to_server,established; content:"|07 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690140; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gr Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|07 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690141; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (win)"; flow:to_server,established; content:"|08 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690142; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (Remmina)"; flow:to_server,established; content:"|08 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690143; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|08 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690144; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with dv Keyboard Layout (win)"; flow:to_server,established; content:"|09 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690145; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with dv Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690146; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with dv Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690147; rev:3;) #alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ESP Keyboard Layout (win)"; flow:to_server,established; content:"|0A 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690148; rev:3;) #alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ESP Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0A 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690149; rev:3;) #alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ESP Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0A 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690150; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with hu Keyboard Layout (win)"; flow:to_server,established; content:"|0E 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690151; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with hu Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0E 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690152; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with hu Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0E 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690153; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with it Keyboard Layout (win)"; flow:to_server,established; content:"|10 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690154; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with it Keyboard Layout (Remmina)"; flow:to_server,established; content:"|10 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690155; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with it Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|10 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690156; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with pl Keyboard Layout (win)"; flow:to_server,established; content:"|15 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690157; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with pl Keyboard Layout (Remmina)"; flow:to_server,established; content:"|15 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690158; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with pl Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|15 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690159; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ru Keyboard Layout (win)"; flow:to_server,established; content:"|19 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690160; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ru Keyboard Layout (Remmina)"; flow:to_server,established; content:"|19 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690161; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with ru Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|19 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690162; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sl Keyboard Layout (win)"; flow:to_server,established; content:"|1B 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690163; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sl Keyboard Layout (Remmina)"; flow:to_server,established; content:"|1B 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690164; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with sl Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|1B 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690165; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with tr Keyboard Layout (win)"; flow:to_server,established; content:"|1F 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690166; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with tr Keyboard Layout (Remmina)"; flow:to_server,established; content:"|1F 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690167; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with tr Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|1F 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690168; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|26 04 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690169; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|26 04 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690170; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|26 04 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690171; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cf Keyboard Layout (win)"; flow:to_server,established; content:"|0C 0C 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690172; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cf Keyboard Layout (Remmina)"; flow:to_server,established; content:"|0C 0C 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690173; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with cf Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|0C 0C 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690174; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|1A 0C 01 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690175; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|1A 0C 01 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690176; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|1A 0C 01 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690177; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (win)"; flow:to_server,established; content:"|08 04 02 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690178; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (Remmina)"; flow:to_server,established; content:"|08 04 02 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690179; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|08 04 02 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690180; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (win)"; flow:to_server,established; content:"|09 04 02 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690181; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 04 02 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690182; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with us Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 04 02 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690183; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with usl Keyboard Layout (win)"; flow:to_server,established; content:"|09 04 03 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690184; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with usl Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 04 03 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690185; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with usl Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 04 03 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690186; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with usr Keyboard Layout (win)"; flow:to_server,established; content:"|09 04 04 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690187; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with usr Keyboard Layout (Remmina)"; flow:to_server,established; content:"|09 04 04 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690188; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with usr Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|09 04 04 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690189; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (win)"; flow:to_server,established; content:"|08 04 05 00|"; offset:148; depth:4; classtype:rpc-portmap-decode; sid:9690190; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (Remmina)"; flow:to_server,established; content:"|08 04 05 00|"; offset:152; depth:4; classtype:rpc-portmap-decode; sid:9690191; rev:3;) alert tcp any any -> any 3389 (msg:"S2Grupo APT Connection to Terminal server with gk Keyboard Layout (rdesktop)"; flow:to_server,established; content:"|08 04 05 00|"; offset:166; depth:4; classtype:rpc-portmap-decode; sid:9690192; rev:3;)