Heartbleed TLS Heartbeat Overflow Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to exploit the Heartbleed vulnerability (CVE-2014-0160) by identifying a specific pattern in TLS heartbeat requests. It looks for a TLS heartbeat request with a type of 0x18 (heartbeat request) and a length greater than 3 bytes, which is indicative of an oversized heartbeat request used in the Heartbleed exploit.