Suspicious Wildcard Certificate on Attack Domain
This rule detects the use of a suspicious wildcard certificate in the TLS handshake where the certificate subject contains a wildcard character followed by a domain name with a specific pattern (6 to 12 alphanumeric characters) and a top-level domain (TLD) from a list associated with malicious activities (xyz, top, club, icu). This pattern is often observed in attack infrastructure, particularly for phishing or command and control (C2) servers, to make them appear more legitimate or to facilitate rapid domain generation. The rule specifically looks for '*.domain.tld' where 'domain' is 6-12 chars and 'tld' is one of the specified suspicious TLDs.
Suricata
