UAT-7810 ORB network - TLS service on non-standard port 99 consistent with C2 relay infrastructure
Detects established TLS traffic originating from the internal network to external destinations on TCP port 99. This port is commonly used in legacy or non-standard configurations and, when combined with TLS, may indicate C2 relay infrastructure or unauthorized exfiltration channels.
Suricata
