Unauthenticated Socket.IO Handshake to Peyara Remote Mouse Service on TCP/1313

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•7

This rule detects potentially unauthorized or suspicious WebSocket connections established over TCP port 1313. It specifically looks for Socket.IO traffic utilizing the 'EIO=4' protocol version and 'websocket' transport, while explicitly checking for the absence of Authorization headers and Sec-WebSocket-Protocol headers. The pattern matching on the raw payload suggests identification of initial handshake or messaging sequences (e.g., '0{' or '40') indicative of unauthenticated interaction with a WebSocket service.