Unauthenticated Socket.IO WebSocket connection to Peyara Remote Mouse (TCP/1313)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•5

This rule detects Socket.IO WebSocket handshake attempts or Engine.IO connection openings targeting TCP port 1313. This pattern is commonly associated with administrative tools, backdoors, or command-and-control frameworks that utilize WebSocket communication over non-standard ports to bypass security controls.