TLS Certificate Harvesting Sweep
This rule detects a TLS certificate harvesting sweep, characterized by a high volume of TLS Server Name Indication (SNI) requests from a single source within a short period. This behavior is indicative of reconnaissance activities where an attacker is attempting to collect information about services running on various hosts by observing their TLS certificates.
Suricata
