alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Server Hello with Downgrade Request to TLS 1.2"; flow:established,to_client; content:"|16|"; startswith; content:"|02|"; distance:4; tls.random; content:"|44 4F 57 4E 47 52 44 01|"; fast_pattern; endswith; reference:url,datatracker.ietf.org/doc/html/rfc8446; reference:url,blog.gypsyengineer.com/en/security/how-does-tls-1-3-protect-against-downgrade-attacks.html; classtype:misc-activity; sid:2071342; rev:1; metadata:attack_target Client_and_Server, created_at 2026_07_28, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_07_28;)