ET INFO Server Hello with Downgrade Request to TLS 1.1 or Lower

Query · suricata

flow:established,to_client;
content:"|16|"; startswith;
content:"|02|"; distance:4;
content:"|44 4F 57 4E 47 52 44 00|"; fast_pattern; offset:35; depth:8;
Raw source ET INFO Server Hello with Downgrade Request to TLS 1.1 or Lower · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tls $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET INFO Server Hello with Downgrade Request to TLS 1.1 or Lower";
    flow:established,to_client;
    content:"|16|"; startswith;
    content:"|02|"; distance:4;
    content:"|44 4F 57 4E 47 52 44 00|"; fast_pattern; offset:35; depth:8;
    reference:url,datatracker.ietf.org/doc/html/rfc8446;
    reference:url,blog.gypsyengineer.com/en/security/how-does-tls-1-3-protect-against-downgrade-attacks.html;
    classtype:misc-activity;
    sid:2071343; rev:1;
    metadata:attack_target Client_Endpoint, created_at 2026_07_28, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_07_28;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.