rdp-scanners.bro

module RDP;

export {
	redef enum Notice::Type += {
		BruteforceScan, 
	}; 

	global rdp_scanners_account = /[a-zA-Z]/ &redef ; 
	redef rdp_scanners_account +=   /NCRACK_USER/ ; 

} 
event rdp_connect_request(c: connection, cookie: string) &priority=5
{
	if (cookie != rdp_scanners_account) {
		return;
	}
	local orig=c$id$orig_h ;
	local resp=c$id$resp_h ; 
	local msg=fmt("%s bruteforced RDP on %s:%s using Account: \"%s\" ", orig, resp, c$id$resp_p, cookie);
	NOTICE([$note=RDP::BruteforceScan,
		$conn=c,
		$src=orig,
		$dst=resp,
		$msg=msg,
		$sub=cookie,
		$identifier=cat(orig)
	]);
}