Unauthenticated Socket.IO Handshake to Remote Mouse Service on TCP 1313

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•6

This rule identifies network connections over port 1313 that initiate a Socket.io WebSocket upgrade request. The detection checks for the presence of the '/socket.io/' URI path, the 'EIO=4' protocol version parameter, and the 'transport=websocket' requirement, which are characteristic of Socket.io communication. This can be used to monitor for potentially unauthorized C2 channels or application-specific tunneling.