New bleeding snort events, not seen this week:

Name:       ET POLICY MS Terminal Server Root login

Class:      protocol-command-decode

References: 
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=2001-0540