Suspicious TLS Cert Valid for Only One Day
This rule detects suspicious TLS certificates that are valid for only one day and have a common name (CN) consisting of 6 or more alphanumeric characters. This pattern is often associated with malware or command and control (C2) activity, where certificates are generated on the fly with short validity periods to evade detection.
Suricata
