ZD TLS Self-signed certificate on outbound connection
This rule detects outbound TLS connections from the internal network to external destinations where the server certificate is self-signed. It identifies connections where both the certificate issuer and subject common names (CN) are present, which is often indicative of opportunistic encryption used by C2 infrastructure or malicious payloads. The rule includes a threshold to reduce noise by limiting alerts for the same source over a specific window.
Suricata
