Free SSL Certificate Issuance for Attack Domain
This rule detects HTTP requests to domains associated with free SSL certificate issuance (Let's Encrypt or ZeroSSL) where the URI contains 'acme'. This could indicate an attacker attempting to obtain a free SSL certificate for a domain they control, potentially for use in phishing or other malicious activities. The rule uses a threshold to prevent excessive alerts from legitimate certificate renewals.
Suricata
