NF – HTTP traffic on port 443 (HEAD)
This alert is triggered when HTTP traffic using the "HEAD" request method is sent over port 443, which is typically reserved for HTTPS traffic. This may indicate an unusual or suspicious use of HTTP on an encrypted port.
ID Number
5023702
Signature
alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"NF - HTTP traffic on port 443 (HEAD)"; flow:to_server,established; content:"HEAD "; depth:5; reference:url,networkforensic.dk; classtype:bad-unknown; metadata:25052017; sid:5023702; rev:1;)
Severity
Medium
Recommendations/Investigative actions
Identify the device initiating the HTTP HEAD request over port 443 to check for misconfigurations.
Restrict or flag any HTTP traffic on port 443, as it may signal a misconfiguration or potential security risk.