ATT&CK T1573 - Suspicious TLS Certificate: Self-Signed C2
This rule detects suspicious TLS certificates that are self-signed and potentially used for Command and Control (C2) communication. Specifically, it looks for TLS certificates where both the issuer and subject country codes are 'US' and the common name (CN) in the subject field consists of 8 or more hexadecimal characters. This pattern is often observed in malware using dynamically generated self-signed certificates for C2.
Suricata
