TA419 shared self-signed TLS certificate observed on phishing send infrastructure

Arnold Chan@slaz

•updated 24 days ago•0•0•1

This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.