MINIRECON possible self-signed TLS certificate on WebSocket-over-HTTPS C2 channel with validation bypass
Detects established TLS traffic over WebSockets where the certificate subject field lacks a common name (CN), often indicative of non-standard, self-signed, or improperly generated TLS certificates used by command-and-control (C2) agents to bypass standard certificate validation or hide within encrypted channels.
Suricata
