ET POLICY TLS possible TOR SSL traffic

Query · suricata

flow:established,from_server;
tls.cert_issuer;
content:"CN=www"; startswith;
content:".com"; endswith;
pcre:"/^CN=www\.[0-9a-z]{8,20}\.com$/";
tls.cert_subject;
content:"CN=www"; startswith;
content:".net"; endswith;
pcre:"/^CN=www\.[0-9a-z]{8,20}\.net$/";
Raw source ET POLICY TLS possible TOR SSL traffic · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp any ![21,25,110,143,443,465,587,636,989:995,5061,5222,8443] -> any any (
    msg:"ET POLICY TLS possible TOR SSL traffic";
    flow:established,from_server;
    tls.cert_issuer;
    content:"CN=www"; startswith;
    content:".com"; endswith;
    pcre:"/^CN=www\.[0-9a-z]{8,20}\.com$/";
    tls.cert_subject;
    content:"CN=www"; startswith;
    content:".net"; endswith;
    pcre:"/^CN=www\.[0-9a-z]{8,20}\.net$/";
    classtype:misc-activity;
    sid:2018789; rev:4;
    metadata:created_at 2014_07_28, confidence High, signature_severity Informational, updated_at 2023_02_16;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.