Export-Grade Cipher Suite Negotiation Detected
This rule detects the negotiation of an export-grade cipher suite during a TCP connection to port 443 (HTTPS). Specifically, it looks for the byte sequence '|00 1B|' at a depth of 2 bytes within the TCP payload, which corresponds to a specific cipher suite identifier often associated with weaker, export-grade cryptography. This could indicate an attempt to downgrade encryption for easier interception or exploitation.
Suricata
