SSLBL: Malicious SSL certificate detected (ConnectWise C&C)

SID: 903208707Rev: 1EnabledDerived4 views
Filesslblacklist_tls_cert.rules
CreatedJanuary 8, 2026
UpdatedJanuary 8, 2026
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (ConnectWise C&C)"; tls_cert_fingerprint; content:"20:0b:fa:a3:2c:98:5a:0f:f5:0f:15:05:35:2a:c5:10:d2:ed:89:3d"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/200bfaa32c985a0ff50f1505352ac510d2ed893d/; sid:903208707; rev:1;)

References

urlsslbl.abuse.ch/ssl-certificates/sha1/200bfaa32c985a0ff50f1505352ac510d2ed893d/

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!