MQTT Publish Subscribe C2 Channel Detected
This rule detects potential command and control (C2) communication over the MQTT protocol. It specifically looks for TCP traffic on port 1883 (the standard MQTT port) from the home network to any destination. The detection is triggered by the presence of a specific byte sequence ('|10|') at the beginning of the payload, which corresponds to an MQTT PUBLISH message type. A threshold of 5 such messages within 60 seconds from the same source IP is set to reduce false positives, indicating a sustained pattern of MQTT PUBLISH activity that could be indicative of C2.
Suricata
