Compromised VPS Used as Proxy Relay
This rule detects potential use of a compromised Virtual Private Server (VPS) as a proxy relay. It specifically looks for HTTP CONNECT requests, which are commonly used for tunneling traffic through a proxy. A threshold of 10 CONNECT requests within 60 seconds from a single source IP is set to identify suspicious activity, indicating a high volume of proxy usage.
Suricata
