After many tries with “reg_sub”, i did finally find a solution:
stick on rdp_cookie(mstshash) upper
→ Perhaps, this is something, that should be changed in the docs:
rdp_cookie([]) : string (deprecated)
When the request buffer looks like the RDP protocol, extracts the RDP cookie
, or any cookie if unspecified. The parser only checks for the first
cookie, as illustrated in the RDP protocol specification. The cookie name is case insensitive. Generally the “MSTS” cookie name will be used, as it can
contain the user name of the client connecting to the server if properly
configured on the client. The “MSTSHASH” cookie is often used as well for
session stickiness to servers.