WaterPlum possible RAT beaconing - periodic low-volume TLS connections lacking recognized CDN/cloud SNI
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
Suricata
