An analyst reviews Zeek ssl.log and notices multiple connections where the subject field of the server certificate is 'CN=localhost' and the issuer matches the subject (self-signed). The connections are outbound to external IPs on port 443. Why is this suspicious?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — a is correct because legitimate internet HTTPS servers use publicly trusted CA-signed certificates; a self-signed certificate from an external IP (especially with CN=localhost) strongly suggests attacker-controlled C2 infrastructure using a quickly generated certificate to encrypt traffic. B is wrong because while internal dev servers may use self-signed certs, outbound connections to external IPs should use publicly trusted certificates.
Full explanation below image
Full Explanation
A is correct because legitimate internet HTTPS servers use publicly trusted CA-signed certificates; a self-signed certificate from an external IP (especially with CN=localhost) strongly suggests attacker-controlled C2 infrastructure using a quickly generated certificate to encrypt traffic. B is wrong because while internal dev servers may use self-signed certs, outbound connections to external IPs should use publicly trusted certificates. C is wrong because Zeek correctly parses and logs self-signed certificate data. D is wrong because if the connection appeared in ssl.log, it was observed; blocked connections would typically not have complete TLS handshake data.