Squid Proxy Used for Internal C2 Routing
This rule detects internal network traffic to port 3128, which is commonly used by Squid proxy servers. The rule is specifically looking for a high volume of such connections (10 connections within 60 seconds from the same source IP) within the home network, suggesting the use of a Squid proxy for internal command and control (C2) routing. The 'flow:to_server,established' indicates that the rule triggers on established connections from a client within the home network to a server within the home network on port 3128.
Suricata
