Application Layer TLS Protocol Used as C2 Transport

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•12

This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.