Rule History

SID: 903203898 • Source: abuse.ch/sslbl-blacklist

Versions (3)

Version DetailsCurrent

Rev: 1 • Jun 25, 2025, 11:40 AM

Message:

SSLBL: Malicious SSL certificate detected (Adwind C&C)

Rule:

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (Adwind C&C)"; tls_cert_fingerprint; content:"44:c1:62:6e:49:64:d8:69:b5:28:26:1b:44:b0:f2:02:fd:89:98:b0"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/44c1626e4964d869b528261b44b0f202fd8998b0/; sid:903203898; rev:1;)

Created:

Jun 25, 2025, 11:40 AM

Updated:

Jun 25, 2025, 11:40 AM

DB Created:

Jul 17, 2025, 2:34 PM

DB Updated:

Jul 17, 2025, 2:34 PM

Filename:

sslblacklist_tls_cert.rules