Non-HTTPS Traffic Tunneled over Port 443

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects non-HTTPS/non-HTTP traffic attempting to tunnel over TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP, indicating potential covert communication or tunneling activity often associated with malware or command and control.