alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Server Hello with Downgrade Request to TLS 1.1 or Lower"; flow:established,to_client; content:"|16|"; startswith; content:"|02|"; distance:4; content:"|44 4F 57 4E 47 52 44 00|"; fast_pattern; offset:35; depth:8; reference:url,datatracker.ietf.org/doc/html/rfc8446; reference:url,blog.gypsyengineer.com/en/security/how-does-tls-1-3-protect-against-downgrade-attacks.html; classtype:misc-activity; sid:2071343; rev:1; metadata:attack_target Client_Endpoint, created_at 2026_07_28, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_07_28;)