Hardware Crypto Acceleration Disabled on Network Device

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects when a network device disables hardware crypto acceleration. It specifically looks for TCP traffic on port 22 (SSH) from any source to the home network, containing the case-insensitive string "no crypto engine". This could indicate a policy violation or an attempt to degrade cryptographic performance, potentially for evasion or to facilitate other attacks.