Unusual Application Traffic on Port 8443

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects unusual application traffic on TCP port 8443. It triggers an alert if a source IP address initiates more than 20 TCP connections to port 8443 within a 60-second window. This threshold-based detection aims to identify potentially malicious or anomalous communication patterns that might indicate command and control activity or data exfiltration over a non-standard port often used for HTTPS.