TLS Client Configuration Fingerprinting

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•2

This rule detects potential TLS client configuration fingerprinting activity. It triggers an alert when a client sends 20 or more TLS Server Name Indication (SNI) requests to a server within a 30-second window. This behavior can be indicative of reconnaissance activities where an attacker is attempting to identify services or configurations on a target network by observing TLS handshakes.