alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO VNC Authentication Successful"; flow:established; flowbits:isset,BSvnc.auth.agreed; flowbits:unset,BSvnc.auth.agreed; flowbits:unset,BSis.vnc.setup; dsize:4; content:"|00 00 00 00|"; depth:4; reference:url,www.cl.cam.ac.uk/Research/DTG/attarchive/vnc/rfbproto.pdf; classtype:not-suspicious; sid:2002922; rev:6; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2024_03_14;)