TLS Downgrade Attack to Weaker Protocol Version

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects a TLS downgrade attack where a client attempts to establish a connection using a weaker TLS protocol version, specifically TLS 1.0. This could indicate an attacker forcing a less secure communication channel to exploit vulnerabilities in older TLS versions.