Potential Tunneling via HTTP Connect
The rule detects HTTP CONNECT requests where the destination port matches a set of suspicious non-standard ports (22, 1080, 1081, 3389, 3128, 8080, 8888, 53, 5900, 4443, 2222) that are commonly associated with tunneling protocols such as SSH, RDP, SOCKS, VNC, and DNS.
YARA-L
