Unauthenticated Socket.IO handshake to Peyara Remote Mouse (TCP 1313)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•6

This rule detects network connections on TCP port 1313 that explicitly use the Socket.IO protocol for WebSocket communication (URI path containing '/socket.io/?EIO=4&transport=websocket'). This pattern may indicate the presence of command and control (C2) traffic, web shells, or unauthorized application communications leveraging WebSocket tunnels over non-standard ports.