Possible periodic TLS beaconing from build/dev host indicative of stolen credential/wallet data exfiltration
Detects periodic, repetitive TLS network connections from internal hosts to external destinations using threshold-based analysis. This pattern is indicative of potential command-and-control (C2) beaconing, which may be used for exfiltrating stolen credentials or sensitive data from build or developer environments.
Suricata
