SSLBL: Malicious SSL certificate detected (CobaltStrike C&C)

SID: 903209823Rev: 1EnabledDerived3 views
Filesslblacklist_tls_cert.rules
CreatedJune 5, 2026
UpdatedJune 5, 2026
alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (CobaltStrike C&C)"; tls_cert_fingerprint; content:"12:a5:0b:5c:46:cc:d3:c1:dc:15:5c:31:eb:30:43:8c:c2:22:5e:89"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/12a50b5c46ccd3c1dc155c31eb30438cc2225e89/; sid:903209823; rev:1;)

References

urlsslbl.abuse.ch/ssl-certificates/sha1/12a50b5c46ccd3c1dc155c31eb30438cc2225e89/

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!