🐾 - 🔔 Many TLS Handshake Failure - Potential SSL Scan activity 🥷 - T1595.002

SID: 3300318Rev: 13 views
Sourcepawpatrules
CreatedAugust 2, 2023
UpdatedAugust 2, 2023
Classificationattempted-recon
alert tls any any -> any any (msg:"🐾 - 🔔 Many TLS Handshake Failure - Potential SSL Scan activity 🥷 - T1595.002"; flow:to_client, stateless; dsize:7; content:"|15|"; content:"|00 02 02 28|"; distance:2; within:4; fast_pattern; threshold:type threshold, track by_src, count 15, seconds 20; reference:url,https://github.com/rbsec/sslscan; reference:url,https://attack.mitre.org/techniques/T1595/002/; classtype:attempted-recon; sid:3300318; rev:1; metadata:created_at 2023_08_02, updated_at 2023_08_02;)

References

urlhttps://github.com/rbsec/sslscan
urlhttps://attack.mitre.org/techniques/T1595/002/

Metadata

created at2023_08_02
updated at2023_08_02

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!