AiTM Reverse-Proxy Phishing Infra: Fresh LE Cert Mimicking IdP Login Domain
Detects network traffic patterns indicative of adversary-in-the-middle (AiTM) phishing infrastructure. The rule identifies suspicious TLS Server Name Indication (SNI) strings matching common SaaS login portals (Microsoft, Okta, Google) paired with SSL/TLS certificates issued by 'Let's Encrypt' that contain suspicious subject names, suggesting a freshly generated infrastructure for credential harvesting.
Suricata
