Outbound TLS session using self-signed certificate (possible cert validation bypass)

Emiliano Mema@Nosalva

•updated Aug 21, 2026•0•0•1

This rule detects outbound TLS connections from the local network to an external destination where the server provides a self-signed certificate. Self-signed certificates are often used by malware for command-and-control (C2) communication or by data exfiltration tools to establish encrypted channels while avoiding the need for legitimate, verifiable PKI infrastructure.