MQTT over TLS Used as Encrypted C2 Channel
This rule detects the use of MQTT (Message Queuing Telemetry Transport) over TLS on port 8883, specifically identifying it as a potential encrypted Command and Control (C2) channel. It triggers an alert if there are at least 5 established TCP connections to port 8883 from a single source within a 60-second window, indicating persistent communication often associated with C2 activities.
Suricata
