Detection of Potential C2 via Recently Issued Self-Signed TLS Certificates

Command-and-control (C2) frameworks frequently utilize freshly generated, self-signed TLS certificates to encrypt communication between compromised hosts and attacker-controlled infrastructure. Unlike publicly trusted certificates, these ephemeral credentials often share an identical issuer and subject distinguished name (DN).

This detection logic monitors outbound TLS traffic from internal network segments to external destinations. By correlating the certificate's not_before date (within the last 30 days) and the equality of the issuer and subject DNs, security teams can identify potentially unauthorized, custom-built C2 infrastructure that evades signature-based detection. This capability is intended to complement existing hash-based rules, such as those targeting default Cobalt Strike team-server certificates. It is highly effective for identifying rotated or unique C2 infrastructure that does not reuse known malicious certificates.

Impact

Successful detection and investigation of these signals allow defenders to identify unauthorized outbound C2 communication. If left unmitigated, attackers can maintain persistent access and exfiltrate data from compromised internal hosts via encrypted channels. The primary risk involves the use of ephemeral, non-standard TLS configurations to bypass traditional reputation-based network filtering.

Recommendation

• Deploy network traffic monitoring to capture TLS handshake metadata, specifically issuer.distinguished_name, subject.distinguished_name, and not_before timestamps.
• Prioritize the investigation of connections that exhibit a mismatch between SNI values and the presented certificate subject.
• Maintain an allowlist of known legitimate destinations that utilize self-signed certificates, such as internal development environments or authorized vendor appliances, to minimize false positives.
• Correlate alerts triggered by this logic with endpoint telemetry or existing C2 indicators to increase the confidence of incident response actions.