TLS cert impersonating Uzbekistan railway authority (azure.uzrailwaystax)

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•6

Detects network traffic involving TLS certificates or Server Name Indication (SNI) values that attempt to impersonate the Uzbekistan state railway authority (azure.uzrailwaystax.com). The rules also flag connections associated with certificates issued by 'TLC DV TLS CA' and known C2 infrastructure using the spoofed railway certificate.