An analyst reviews Zeek ssl.log and notices multiple connections where the subject field of the server certificate is 'CN=localhost' and the issuer matches the subject (self-signed). The connections are outbound to external IPs on port 443. Why is this suspicious?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — when you see outbound HTTPS to external IPs with a self-signed certificate like CN=localhost, you're likely talking to attacker-controlled infrastructure. Legitimate internet HTTPS servers use publicly trusted CA-signed certificates, so a self-signed cert is a red flag for C2 traffic.
Full Explanation
The correct answer is that external HTTPS servers are required to use certificates signed by a public CA; a self-signed certificate from an external IP, especially with CN=localhost, strongly suggests attacker-controlled C2 infrastructure using a quickly generated certificate to encrypt traffic. The option saying self-signed certificates are always used for internal development and should be blocked at the perimeter is wrong because while internal development servers may use self-signed certificates, outbound connections to external IPs should use publicly trusted certificates. The option saying Zeek cannot correctly parse self-signed certificates is wrong because Zeek correctly parses and logs self-signed certificate data. The option saying the ssl.log entry indicates the connection was blocked by the SSL inspection proxy is wrong because if the connection appeared in ssl.log, it was observed; blocked connections would typically not have complete TLS handshake data.