Unauthenticated Socket.IO WebSocket Handshake to Peyara Remote Mouse on TCP/1313

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•2

This rule detects unauthorized or unauthenticated WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. The detection looks for specific URL patterns characteristic of the Socket.IO protocol (EIO=4, transport=websocket) that indicate an attempt to establish a connection with the vulnerable service without proper credential exchange.