🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port - Suricata Rule 3300298 (pawpatrules)

🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port

SID: 3300298Rev: 9Enabled56 viewsHistory

FilePAW-PATRULES_VULN.rules

CreatedFebruary 11, 2022

UpdatedSeptember 9, 2026

Classificationpolicy-violation

alert tcp any any -> any ![443,465,563,587,636,695,853,898,989,990,992,993,994,995,2376,2484,3269,4116,3424,4843,5061,5085,5228,5349,5671,5986,6513,6514,6619,6697,8243,8883,8531] (msg:"🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port"; flow:to_server, stateless; app-layer-protocol:tls; threshold:type limit, track by_src, seconds 60, count 1; reference:url,https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers; metadata:created_at 2022_02_11, updated_at 2026_09_09; sid:3300298; rev:9; classtype:policy-violation;)

References

url	https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

🐾 - 🚨 Suspicious 👀 SSL/TLS trafic on unusual SSL/TLS port

References

Metadata

Comments (0)