Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension

Last updated 2 months ago on 2026-06-12

Created 2 months ago on 2026-06-12

About

This rule detects two ALPN-based denial-of-service patterns against TLS servers. The first identifies repeated stalled handshakes advertising the acme-tls/1 ALPN extension with no session established, indicating potential goroutine or worker exhaustion in reverse proxies. The second matches connections where a malformed ALPN extension triggers TLS alerts such as decode_error or illegal_parameter, consistent with zero-length ALPN list exploitation. Both patterns are anomalous outside of scheduled ACME TLS-ALPN-01 certificate validation activity.

Tags

Domain: NetworkUse Case: Threat DetectionUse Case: Network Security MonitoringUse Case: VulnerabilityData Source: Network TrafficTactic: ImpactLanguage: esql

Severity

low

Risk Score

MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Endpoint Denial of Service (T1499)(external, opens in a new tab or window)

False Positive Examples

Legitimate ACME certificate renewal agents (cert-manager, Certbot, Caddy) use acme-tls/1 during TLS-ALPN-01 challenges. A single incomplete challenge due to a network timeout can occur normally, but five or more incomplete sessions from the same source within the detection window is abnormal even for misconfigured ACME clients. TLS decode_error or illegal_parameter alerts can also be produced by buggy TLS clients or misconfigured load balancers. Suppress by adding known ACME client source IPs or ACME CA validation IP ranges to an exception list.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack: Prebuilt Security Detection Rules
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗from logs-network_traffic.tls*
| where source.ip is not null and destination.ip is not null and (
    (
      tls.detailed.client_hello.extensions.application_layer_protocol_negotiation == "acme-tls/1" and
      tls.established == false
    ) or (
      CONTAINS(TO_LOWER(tls.detailed.client_hello.extensions._unparsed_), "alpn") and
      tls.detailed.alert_types in ("decode_error", "illegal_parameter")
    )
  )
| stats
    Esql.event_count = COUNT(*),
    Esql.destination_port_values = MV_SLICE(MV_DEDUPE(TOP(destination.port, 10, "asc")), 0, 10),
    Esql.network_community_id_values = MV_SLICE(MV_DEDUPE(TOP(network.community_id, 10, "asc")), 0, 10),
    Esql.alpn_values = MV_SLICE(
      MV_DEDUPE(TOP(tls.detailed.client_hello.extensions.application_layer_protocol_negotiation, 10, "asc")),
      0,
      10
    ),
    Esql.alert_type_values = MV_SLICE(MV_DEDUPE(TOP(tls.detailed.alert_types, 10, "asc")), 0, 10)
  by source.ip, destination.ip
| where Esql.event_count >= 5
| keep
    source.ip,
    destination.ip,
    Esql.event_count,
    Esql.destination_port_values,
    Esql.network_community_id_values,
    Esql.alpn_values,
    Esql.alert_type_values

Install detection rules in Elastic Security

Detect Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).