Versions (2)
Version DetailsCurrent
Rev: 2 • Mar 13, 2026, 12:00 PMET JA3 Hash - Possible SoftEther Windows Client SSTP Traffic
alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET JA3 Hash - Possible SoftEther Windows Client SSTP Traffic"; flow:established,to_server; ja3.hash; content:"2800f914a7a4ba98aa9df62d316a460c"; reference:url,www.softether.org/4-docs/1-manual; classtype:misc-activity; sid:2068224; rev:2; metadata:affected_product SoftEther, attack_target Client_Endpoint, tls_state TLSEncrypt, created_at 2026_03_13, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_03_15, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Software; target:src_ip;)
Mar 13, 2026, 12:00 PM
Mar 15, 2026, 12:00 PM
Mar 13, 2026, 8:34 PM
Mar 15, 2026, 2:34 AM
rules/emerging-ja3.rules