🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port - Suricata Rule 3300298 (pawpatrules)

🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port

SID: 3300298Rev: 845 views

Sourcepawpatrules

CreatedFebruary 11, 2022

UpdatedJune 15, 2022

Classificationpolicy-violation

alert tcp any any -> any ![443,465,563,587,636,695,853,898,989,990,992,993,994,995,2376,2484,3269,4116,3424,4843,5061,5085,5228,5349,5671,5986,6513,6514,6619,6697,8243,8883] (msg:"🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port"; flow:to_server, stateless; app-layer-protocol:tls; threshold:type limit, track by_src, seconds 60, count 1; reference:url,https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers; metadata:created_at 2022_02_11, updated_at 2022_06_15; sid:3300298; rev:8; classtype:policy-violation;)

References

url	https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port

References

Metadata

Comments (0)