ZD TLS SNI is an IP literal - atypical for legitimate services
This rule detects TLS handshakes where the Server Name Indication (SNI) field contains an IP address literal instead of a domain name. Legitimate web services and applications typically use FQDNs for TLS SNI to support virtual hosting. Using an IP literal in the SNI field is a technique often used by malware, C2 infrastructure, and malicious scripts to establish encrypted connections while avoiding standard DNS lookups, which may be logged or monitored.
Suricata
