You can try an aotmic IP engine signature that matches on port 3389. You can set the event count key to attacker and victim address pair and event count to a suitable number (say 5) and event count interval to a suitable interval (say 30 seconds). You can also match on additional details (like a RST flag as well in theTCP header which ideally should follow a failed login attempt). If you do this, you will want to sepcify the source port as TCP 3389 and also enable swap attacker-victim addresses so that destination IP address is detected as the attacker. You can then set the action to "deny attacker victim pair inline" and any traffic between these 2 guys will be blocked for a period of time (default is 30 miniutes if i remember correct). Effectively, the signature will try to match 5 TCP packets in 30 seconds with a source port of 3389 and between the same set of IP addresses. If that condition matches, it will stop all traffic between these 2 hosts for a defined period of time. Again, the numbers i mentioned above may not suit your requirement. You might have to run wireshark and see the pattern and match accordingly. Hope this helps! Regards, Prapanch ... View more