Skip to content
Threat Feed

Tag

Encrypted-Channel

1 brief RSS
low advisory

Unusual Windows Processes Connecting to Domains Using Free SSL Certificates

This rule identifies unusual Windows processes connecting to domains using known free SSL certificates such as Let's Encrypt, which adversaries may use to conceal command and control traffic.

MicrosoftEdge command-and-control encrypted-channel freessl
2r 1t 4i