Deprecated TLS Version or Weak Cipher Negotiated Externally

  1[metadata]
  2creation_date = "2026/06/25"
  3integration = ["network_traffic"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies successful outbound TLS sessions that negotiate deprecated protocol versions (SSLv3, TLS 1.0, or TLS 1.1) or
 11weak cipher suites such as RC4, 3DES, NULL, EXPORT, or anonymous Diffie-Hellman. Adversaries-in-the-middle and legacy
 12malware often force these negotiations to decrypt or intercept traffic. Modern clients and services should negotiate TLS
 131.2 or 1.3 with strong ciphers on internet-bound connections.
 14"""
 15false_positives = [
 16    """
 17    Legacy internal applications, industrial control systems, or embedded devices may still require deprecated TLS
 18    versions or weak ciphers. Exclude known legacy destination IPs or subnets after validation.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-network_traffic.tls-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "Deprecated TLS Version or Weak Cipher Negotiated Externally"
 26note = """## Triage and analysis
 27
 28> **Disclaimer**:
 29> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 30
 31### Investigating Deprecated TLS Version or Weak Cipher Negotiated Externally
 32
 33TLS downgrade and weak-cipher negotiation expose sessions to interception or decryption. This rule flags completed
 34outbound TLS handshakes from internal hosts to external destinations that negotiated SSLv3, TLS 1.0, TLS 1.1, or a
 35cipher suite containing RC4, 3DES, NULL, EXPORT, or anonymous key exchange material.
 36
 37### Possible investigation steps
 38
 39- Review `source.ip`, `destination.ip`, `destination.port`, `tls.version`, `tls.version_protocol`, and `tls.cipher`.
 40- Determine whether the destination is a known legacy partner, vendor appliance, or unmanaged IoT device.
 41- Check for concurrent alerts on the source host (credential access, C2, or proxy manipulation).
 42- Compare against baseline: does this destination normally negotiate modern TLS from other clients?
 43
 44### False positive analysis
 45
 46- Exclude validated legacy B2B endpoints, mainframe gateways, or SCADA systems that cannot be upgraded immediately.
 47- Some older mobile or embedded clients may still offer weak ciphers even when connecting to modern services; confirm
 48  whether the server accepted the weak option (this rule requires `tls.established:true`).
 49
 50### Response and remediation
 51
 52- Block or proxy traffic to the destination if downgrade appears attacker-driven.
 53- Patch or replace the client or server that accepted deprecated TLS.
 54- Enable TLS 1.2+ minimums on egress proxies and inspect for MITM appliances forcing weak negotiation.
 55"""
 56references = [
 57    "https://attack.mitre.org/techniques/T1557/",
 58    "https://www.elastic.co/docs/reference/integrations/network_traffic",
 59    "https://www.elastic.co/docs/reference/ecs/ecs-tls",
 60    "https://www.rfc-editor.org/rfc/rfc9325.html",
 61]
 62risk_score = 47
 63rule_id = "d994a184-ab93-4cff-8fb6-31a4b4dd18b1"
 64setup = """## Setup
 65
 66This rule requires TLS metadata from the Elastic network_traffic integration (`network_traffic.tls` data stream) that
 67populates ECS `tls.version`, `tls.version_protocol`, `tls.cipher`, and `tls.established` fields.
 68"""
 69severity = "medium"
 70tags = [
 71    "Domain: Network",
 72    "Use Case: Network Security Monitoring",
 73    "Use Case: Threat Detection",
 74    "Data Source: Network Traffic",
 75    "Tactic: Credential Access",
 76    "Tactic: Command and Control",
 77    "Resources: Investigation Guide",
 78    "Noise: Low",
 79    "Performance: Fast",
 80    "Rule Type: New Terms",
 81    "Data Source: Network Packet Capture",
 82]
 83timestamp_override = "event.ingested"
 84type = "new_terms"
 85
 86query = '''
 87data_stream.dataset:network_traffic.tls
 88  and network.protocol: tls
 89  and network.transport: tcp
 90  and tls.established: true
 91  and source.ip:(10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
 92  and not destination.ip:(
 93    10.0.0.0/8 or
 94    100.64.0.0/10 or
 95    127.0.0.0/8 or
 96    169.254.0.0/16 or
 97    172.16.0.0/12 or
 98    192.0.0.0/24 or
 99    192.0.0.0/29 or
100    192.0.0.10/32 or
101    192.0.0.170/32 or
102    192.0.0.171/32 or
103    192.0.0.8/32 or
104    192.0.0.9/32 or
105    192.0.2.0/24 or
106    192.168.0.0/16 or
107    192.175.48.0/24 or
108    192.31.196.0/24 or
109    192.52.193.0/24 or
110    192.88.99.0/24 or
111    198.18.0.0/15 or
112    198.51.100.0/24 or
113    203.0.113.0/24 or
114    224.0.0.0/4 or
115    240.0.0.0/4 or
116    "::1" or
117    "FE80::/10" or
118    "FF00::/8"
119  )
120  and (
121    tls.version:(1.0 or 1.1) or
122    (tls.version_protocol:ssl and tls.version:3.0) or
123    (
124      not tls.version:1.3 and (
125        tls.cipher:(
126          *RC4* or
127          *3DES* or
128          *NULL* or
129          *EXPORT* or
130          *_anon_* or
131          *ADH* or
132          *AECDH*
133        )
134      )
135    )
136  )
137'''
138
139
140[[rule.threat]]
141framework = "MITRE ATT&CK"
142[[rule.threat.technique]]
143id = "T1557"
144name = "Adversary-in-the-Middle"
145reference = "https://attack.mitre.org/techniques/T1557/"
146
147
148[rule.threat.tactic]
149id = "TA0006"
150name = "Credential Access"
151reference = "https://attack.mitre.org/tactics/TA0006/"
152[[rule.threat]]
153framework = "MITRE ATT&CK"
154[[rule.threat.technique]]
155id = "T1573"
156name = "Encrypted Channel"
157reference = "https://attack.mitre.org/techniques/T1573/"
158
159
160[rule.threat.tactic]
161id = "TA0011"
162name = "Command and Control"
163reference = "https://attack.mitre.org/tactics/TA0011/"
164
165[rule.new_terms]
166field = "new_terms_fields"
167value = ["source.ip", "destination.ip", "tls.version"]
168[[rule.new_terms.history_window_start]]
169field = "history_window_start"
170value = "now-7d"