A Suricata rule developer wants to write a rule that detects outbound HTTPS connections where the TLS SNI (Server Name Indication) contains a known malicious domain. Which Suricata keyword targets the TLS SNI field?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Suricata's tls.sni keyword is a sticky buffer that matches against the Server Name Indication extension in the TLS ClientHello message, which contains the hostname the client is trying to reach — useful for detecting malicious domains even over encrypted HTTPS. A is wrong because http.host targets the HTTP Host header in cleartext HTTP requests, not TLS SNI in encrypted connections.
Full explanation below image
Full Explanation
B is correct because Suricata's tls.sni keyword is a sticky buffer that matches against the Server Name Indication extension in the TLS ClientHello message, which contains the hostname the client is trying to reach — useful for detecting malicious domains even over encrypted HTTPS. A is wrong because http.host targets the HTTP Host header in cleartext HTTP requests, not TLS SNI in encrypted connections. C is wrong because dns.query matches on DNS query names at the DNS protocol level, not TLS handshake fields. D is wrong because ssl.cert_subject matches the Subject field of the server's X.509 certificate, not the client's SNI request.