This rule detects outbound TLS connections to external destinations where the remote server presents a recently issued self-signed certificate (issuer distinguished_name equals subject distinguished_name) and the certificate’s not_before date falls within the last 30 days. It targets command-and-control activity that commonly uses ephemeral, self-signed certificates instead of public CA-issued credentials. The detection relies on TLS metadata from Elastic network_traffic (Packetbeat TLS) and requires a full TLS handshake (resumed sessions typically omit certificate fields). Matches are aggregated by source IP, destination IP, certificate subject DN, and not_before to collapse repeated handshakes within the detection window. Distinguishing self-signed from privately CA-signed or publicly trusted certificates is not cryptographic proof; private-CA leaves and publicly trusted certificates (e.g., Let's Encrypt) are not matched. This rule complements hash-based detections of known tooling certificates by catching rotated or custom self-signed infrastructure that may not reuse default tooling certs such as those used by common C2 frameworks.