alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO VNC Authentication Failure"; flow:established; flowbits:isset,BSvnc.auth.agreed; dsize:<50; content:"|00 00 00 01|"; depth:4; reference:url,www.cl.cam.ac.uk/Research/DTG/attarchive/vnc/rfbproto.pdf; classtype:attempted-admin; sid:2002920; rev:6; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2024_03_14;)