Help on rdp session based Persistence

I suppose you need is events like SERVER_CONNECTED and SERVER_DATA

 

 

In theory this is what you might need

 

 

  
  when SERVER_CONNECTED {  
   Collect using[TCP::collect]  
  }  
  when SERVER_DATA {  
  Search for username using [TCP::payload]  
  Then do a replace using TCP::payload replace     
  Then release using [TCP::release]  
  }  
  

 

 

I don't have any RDP servers to test against but I think this would be good start for the logic and try to use the forum to Frankenstein the code together.

 

 

I hope this helps.

 

 

Bhattman