Repeated Socket.IO Handshake/Event-Injection Pattern to TCP 1313 (Remote Mouse Metasploit Exploit)
The rule identifies potential network scanning or probing activity by detecting a high frequency of network connection attempts (3 or more within a 1-minute window) directed at a specific remote port, 1313. This port is often associated with non-standard services or custom applications and may indicate reconnaissance or unauthorized service discovery.
Cortex XDR
