ATT&CK T1095 - Non-HTTP Traffic on Port 443

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects non-HTTP traffic on TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP. This could indicate command and control (C2) activity attempting to blend in with legitimate HTTPS traffic.