(spp_ssl) Invalid Client HELLO after Server HELLO Detected
The rule is designed to trigger an alert when it detects an invalid SSL client hello message. The client hello message is the first message sent by a client when initiating an SSL handshake with a server. It includes various parameters and cipher suites supported by the client, allowing the server to negotiate a secure connection.
ID Number
0000001
Signature
alert ( msg: "SSL_INVALID_CLIENT_HELLO"; sid: 1; gid: 137; rev: 2; metadata: rule-type preproc ; classtype:bad-unknown; reference:url,technet.microsoft.com/en-us/security/bulletin/ms04-011; reference:cve,2004-0120; reference:bugtraq,10115; )
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Can be disabled will trigger many False Positives