WebSocket (wss://) connection to Kratos AiTM relay backend for real-time token capture

Duo Tech@duotech

•updated Jul 14, 2026•4•0•5

This rule identifies network traffic utilizing the WebSocket (wss://) protocol. WebSockets are commonly used for real-time web communications, but adversaries may also use them to establish C2 channels or tunnel traffic to bypass security controls by blending in with standard web traffic.