Rule Document 1:67373

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER eMudhra compromised intermediate TLS CA certificate

Rule Explanation

This rule alerts on known compromised TLS CA issuer certificates being used in certificate chains. The use of these certificates indicates an attempt to forge a valid CA server certificate by an attacker for use in TLS MITM attacks.

What To Look For

This rule alerts on known compromised TLS CA issuer certificates being used in certificate chains. The use of these certificates indicates an attempt to forge a valid CA server certificate by an attacker for use in TLS MITM attacks.

Known Usage

Public information/Proof of Concept available

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group