🐾 - 🔔 Many TLS Handshake Failure - Potential SSL Scan activity 🥷 - T1595.002 - Suricata Rule 3300318 (pawpatrules)

🐾 - 🔔 Many TLS Handshake Failure - Potential SSL Scan activity 🥷 - T1595.002

SID: 3300318Rev: 1Enabled4 views

FilePAW-PATRULES_LATERAL_MOVEMENT.rules

CreatedAugust 2, 2023

UpdatedAugust 2, 2023

Classificationattempted-recon

alert tls any any -> any any (msg:"🐾 - 🔔 Many TLS Handshake Failure - Potential SSL Scan activity 🥷 - T1595.002"; flow:to_client, stateless; dsize:7; content:"|15|"; content:"|00 02 02 28|"; distance:2; within:4; fast_pattern; threshold:type threshold, track by_src, count 15, seconds 20; reference:url,https://github.com/rbsec/sslscan; reference:url,https://attack.mitre.org/techniques/T1595/002/; classtype:attempted-recon; sid:3300318; rev:1; metadata:created_at 2023_08_02, updated_at 2023_08_02;)

References

url	https://github.com/rbsec/sslscan
url	https://attack.mitre.org/techniques/T1595/002/

🐾 - 🔔 Many TLS Handshake Failure - Potential SSL Scan activity 🥷 - T1595.002

References

Metadata

Comments (0)