HTTPS Server Banner Grabbing

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTPS server banner grabbing attempts. It triggers an alert when a client sends 20 or more 'HEAD' HTTP requests to an HTTPS server on port 443 within a 30-second window, indicating an attempt to gather information about the server.