Signature for capturing passwords is specific to the protocol that is being used. Some protocols (anything encrypted) are impossible to catch passwords, others are quite easy (ie. ftp, telnet, etc.).
Let's use ftp as an example. To capture the password you could right a signature with a RegexString of "[Pp][Aa][Ss][Ss].*[\r\n]" and a ServicePorts of 21. This would alarm when anyone logs into an ftp server. You could set a filter to filter out all IN->IN traffic. This would also have the side effect of displaying the password in the context data (if that is what you meant about catching).
