Possible BridgeAgent-style periodic TLS beaconing to port 443

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•1

Detects periodic TLS network beacons to external destinations on port 443, characteristic of the BridgeAgent malware. The rule identifies suspicious outbound connections that exhibit consistent, repetitive behavior patterns, potentially indicating C2 communication. It is recommended to correlate this network activity with EDR alerts focusing on masquerading processes, specifically instances where binaries like gnome-shell are running as root and persisted via service mechanisms like zabbix_agent.service.