Self-Signed Certificate on Newly Registered Domain
This rule detects the use of self-signed TLS certificates on newly registered domains, specifically those ending in .xyz, .top, .club, .online, or .site. It looks for certificates where both the issuer and subject Common Name (CN) fields are present, and the subject CN matches a pattern indicative of a newly registered domain (5 to 20 alphanumeric characters followed by one of the specified TLDs). This pattern is often associated with malicious infrastructure setup.
Suricata
