Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension

This rule detects two ALPN-based denial-of-service patterns against TLS servers. The first identifies repeated stalled handshakes advertising the acme-tls/1 ALPN extension with no session established, indicating potential goroutine or worker exhaustion in reverse proxies. The second matches connections where a malformed ALPN extension triggers TLS alerts such as decode_error or illegal_parameter, consistent with zero-length ALPN list exploitation. Both patterns are anomalous outside of scheduled ACME TLS-ALPN-01 certificate validation activity.

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2026/06/12"
 3integration = ["network_traffic"]
 4maturity = "production"
 5updated_date = "2026/06/12"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10This rule detects two ALPN-based denial-of-service patterns against TLS servers. The first identifies repeated stalled
11handshakes advertising the acme-tls/1 ALPN extension with no session established, indicating potential goroutine or
12worker exhaustion in reverse proxies. The second matches connections where a malformed ALPN extension triggers TLS
13alerts such as decode_error or illegal_parameter, consistent with zero-length ALPN list exploitation. Both patterns are
14anomalous outside of scheduled ACME TLS-ALPN-01 certificate validation activity.
15"""
16false_positives = [
17    """
18    Legitimate ACME certificate renewal agents (cert-manager, Certbot, Caddy) use acme-tls/1 during TLS-ALPN-01
19    challenges. A single incomplete challenge due to a network timeout can occur normally, but five or more incomplete
20    sessions from the same source within the detection window is abnormal even for misconfigured ACME clients. TLS
21    decode_error or illegal_parameter alerts can also be produced by buggy TLS clients or misconfigured load balancers.
22    Suppress by adding known ACME client source IPs or ACME CA validation IP ranges to an exception list.
23    """,
24]
25from = "now-9m"
26language = "esql"
27license = "Elastic License v2"
28max_signals = 5
29name = "Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension"
30note = """## Triage and analysis
31
32> **Disclaimer**:
33> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
34
35### Investigating Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension
36
37This rule fires when five or more TLS connections from the same source IP to the same destination IP
38are recorded where the ClientHello advertises `acme-tls/1` as an ALPN protocol, the handshake never
39completes (`tls.established: false`), or where malformed ALPN data produces a relevant TLS alert.
40Individually, an incomplete ACME challenge can be a transient network issue. In volume, this pattern is
41consistent with attempts to exhaust reverse proxy resources, including CVE-2026-22045, and cause a
42denial of service.
43
44Packetbeat TLS events describe the TLS handshake and do not include connection byte totals or reliable
45elapsed duration for an incomplete handshake. Use `network_traffic.flow` events correlated by
46`network.community_id` when byte counts or connection duration are required during investigation.
47
48`acme-tls/1` is legitimately used only by ACME certificate clients performing TLS-ALPN-01 domain
49validation. Repeated stalled sessions outside of scheduled certificate renewal windows are anomalous.
50
51### Possible investigation steps
52
53- Identify the source IP (`source.ip`) and verify whether it belongs to a known ACME certificate
54  authority (Let's Encrypt: 66.133.109.0/24, 172.65.32.248/28; ZeroSSL; Buypass) or an authorized
55  internal ACME renewal agent. Traffic from unexpected sources is the primary indicator of exploitation.
56- Pivot to `destination.ip` and `destination.port` to determine which TLS listener is targeted and
57  whether it is internet-exposed. Traefik, nginx, HAProxy, and similar reverse proxies are the
58  most likely targets.
59- Count total stalled events from the same `source.ip` over the past hour to understand the full
60  attack volume:
61  ```esql
62  FROM logs-network_traffic.tls*
63  | WHERE tls.detailed.client_hello.extensions.application_layer_protocol_negotiation == "acme-tls/1"
64    AND tls.established == false
65  | STATS count = COUNT(*) BY source.ip, destination.ip, destination.port
66  | SORT count DESC

• If flow reporting is enabled, correlate logs-network_traffic.flow-* events on network.community_id to review network.bytes, source.bytes, destination.bytes, and event.duration.
• Check server-side metrics on the destination host around the alert time: goroutine count for Go services (Traefik, Caddy), worker or thread count for nginx or HAProxy, and TCP accept queue depth. Saturation aligned with the alert window confirms impact.
• Review whether the targeted service is patched for CVE-2026-22045. Traefik versions before the fix did not enforce handshake timeouts on acme-tls/1 listeners, allowing indefinite goroutine hold.

False positive analysis

• cert-manager, Certbot, or Caddy ACME clients produce acme-tls/1 connections during certificate renewal. These complete quickly under normal conditions; isolated stalled events from recognized ACME client IPs are likely transient network issues, not attacks. The threshold of five events within the detection window suppresses most one-off failures.
• Load balancer health checks misconfigured to probe with TLS-ALPN-01 can generate this pattern; identify the health check source IP and add it to the exception list.

Response and remediation

• If the source IP is not a known ACME CA or authorized renewal agent, block it at the perimeter.
• Upgrade Traefik to a version patched for CVE-2026-22045. Apply equivalent handshake-timeout configurations on other reverse proxies (ssl_handshake_timeout in nginx).
• Enforce a TLS handshake timeout at the listener level to bound how long any stalled connection can hold a goroutine or worker slot.
• Rate-limit inbound TLS connections per source IP at the network boundary to limit the blast radius of connection-exhaustion attacks.
• If service degradation is confirmed, restart the affected reverse proxy after applying timeout mitigations to recover exhausted resources. """ references = [ "https://nvd.nist.gov/vuln/detail/CVE-2026-22045", "https://nvd.nist.gov/vuln/detail/CVE-2024-5535", "https://www.rfc-editor.org/rfc/rfc8737", "https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-tls.html", ] risk_score = 21 rule_id = "581bd9b4-ee08-415a-97d7-756e6c53c264" setup = """## Setup

This rule requires the Elastic Agent network_traffic integration with TLS protocol parsing enabled and include_detailed_fields: true (the default). Without this setting, the field tls.detailed.client_hello.extensions.application_layer_protocol_negotiation is not populated and the rule will not match.

Verify your network_traffic integration configuration includes:

1packetbeat.protocols:
2  - type: tls
3    ports: [443, 8443, 9443]
4    include_detailed_fields: true
5    transaction_timeout: 30s

Adjust the port list to cover all TLS listeners in your environment that could be targeted, including reverse proxy listeners and custom TLS service ports. The include_detailed_fields key defaults to true; if it was explicitly disabled, re-enable it and restart the agent.

Packetbeat's default TLS transaction_timeout is 10 seconds. Incomplete handshakes that remain idle beyond this timeout can expire without producing a network_traffic.tls event. Configure transaction_timeout to exceed the longest incomplete-handshake interval you intend to observe. The example above uses 30 seconds; increasing this value retains connection state longer and can increase memory usage on high-volume sensors. """ severity = "low" tags = [ "Domain: Network", "Use Case: Threat Detection", "Use Case: Network Security Monitoring", "Use Case: Vulnerability", "Data Source: Network Traffic", "Tactic: Impact", "Resources: Investigation Guide", ] timestamp_override = "event.ingested" type = "esql"

query = ''' from logs-network_traffic.tls* | where source.ip is not null and destination.ip is not null and ( ( tls.detailed.client_hello.extensions.application_layer_protocol_negotiation == "acme-tls/1" and tls.established == false ) or ( CONTAINS(TO_LOWER(tls.detailed.client_hello.extensions.unparsed), "alpn") and tls.detailed.alert_types in ("decode_error", "illegal_parameter") ) ) | stats Esql.event_count = COUNT(*), Esql.destination_port_values = MV_SLICE(MV_DEDUPE(TOP(destination.port, 10, "asc")), 0, 10), Esql.network_community_id_values = MV_SLICE(MV_DEDUPE(TOP(network.community_id, 10, "asc")), 0, 10), Esql.alpn_values = MV_SLICE( MV_DEDUPE(TOP(tls.detailed.client_hello.extensions.application_layer_protocol_negotiation, 10, "asc")), 0, 10 ), Esql.alert_type_values = MV_SLICE(MV_DEDUPE(TOP(tls.detailed.alert_types, 10, "asc")), 0, 10) by source.ip, destination.ip | where Esql.event_count >= 5 | keep source.ip, destination.ip, Esql.event_count, Esql.destination_port_values, Esql.network_community_id_values, Esql.alpn_values, Esql.alert_type_values '''

[[rule.threat]] framework = "MITRE ATT&CK" [[rule.threat.technique]] id = "T1499" name = "Endpoint Denial of Service" reference = "https://attack.mitre.org/techniques/T1499/" [[rule.threat.technique.subtechnique]] id = "T1499.002" name = "Service Exhaustion Flood" reference = "https://attack.mitre.org/techniques/T1499/002/"

[rule.threat.tactic] id = "TA0040" name = "Impact" reference = "https://attack.mitre.org/tactics/TA0040/"

Triage and analysis

Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension

This rule fires when five or more TLS connections from the same source IP to the same destination IP are recorded where the ClientHello advertises acme-tls/1 as an ALPN protocol, the handshake never completes (tls.established: false), or where malformed ALPN data produces a relevant TLS alert. Individually, an incomplete ACME challenge can be a transient network issue. In volume, this pattern is consistent with attempts to exhaust reverse proxy resources, including CVE-2026-22045, and cause a denial of service.

Packetbeat TLS events describe the TLS handshake and do not include connection byte totals or reliable elapsed duration for an incomplete handshake. Use network_traffic.flow events correlated by network.community_id when byte counts or connection duration are required during investigation.

acme-tls/1 is legitimately used only by ACME certificate clients performing TLS-ALPN-01 domain validation. Repeated stalled sessions outside of scheduled certificate renewal windows are anomalous.

Possible investigation steps

• Identify the source IP (source.ip) and verify whether it belongs to a known ACME certificate authority (Let's Encrypt: 66.133.109.0/24, 172.65.32.248/28; ZeroSSL; Buypass) or an authorized internal ACME renewal agent. Traffic from unexpected sources is the primary indicator of exploitation.
• Pivot to destination.ip and destination.port to determine which TLS listener is targeted and whether it is internet-exposed. Traefik, nginx, HAProxy, and similar reverse proxies are the most likely targets.
• Count total stalled events from the same source.ip over the past hour to understand the full attack volume:

  1FROM logs-network_traffic.tls*
  2| WHERE tls.detailed.client_hello.extensions.application_layer_protocol_negotiation == "acme-tls/1"
  3  AND tls.established == false
  4| STATS count = COUNT(*) BY source.ip, destination.ip, destination.port
  5| SORT count DESC
  

• If flow reporting is enabled, correlate logs-network_traffic.flow-* events on network.community_id to review network.bytes, source.bytes, destination.bytes, and event.duration.
• Check server-side metrics on the destination host around the alert time: goroutine count for Go services (Traefik, Caddy), worker or thread count for nginx or HAProxy, and TCP accept queue depth. Saturation aligned with the alert window confirms impact.
• Review whether the targeted service is patched for CVE-2026-22045. Traefik versions before the fix did not enforce handshake timeouts on acme-tls/1 listeners, allowing indefinite goroutine hold.

False positive analysis

• cert-manager, Certbot, or Caddy ACME clients produce acme-tls/1 connections during certificate renewal. These complete quickly under normal conditions; isolated stalled events from recognized ACME client IPs are likely transient network issues, not attacks. The threshold of five events within the detection window suppresses most one-off failures.
• Load balancer health checks misconfigured to probe with TLS-ALPN-01 can generate this pattern; identify the health check source IP and add it to the exception list.

Response and remediation

• If the source IP is not a known ACME CA or authorized renewal agent, block it at the perimeter.
• Upgrade Traefik to a version patched for CVE-2026-22045. Apply equivalent handshake-timeout configurations on other reverse proxies (ssl_handshake_timeout in nginx).
• Enforce a TLS handshake timeout at the listener level to bound how long any stalled connection can hold a goroutine or worker slot.
• Rate-limit inbound TLS connections per source IP at the network boundary to limit the blast radius of connection-exhaustion attacks.
• If service degradation is confirmed, restart the affected reverse proxy after applying timeout mitigations to recover exhausted resources.