TeamViewer Protocol Port Used for Remote C2
This rule detects the use of TCP port 5938, which is commonly associated with the TeamViewer protocol. The rule is specifically looking for established connections to this port, indicating potential remote command and control (C2) activity. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent TeamViewer usage while still catching suspicious patterns.
Suricata
