A Suricata rule developer wants to write a rule that detects outbound HTTPS connections where the TLS SNI (Server Name Indication) contains a known malicious domain. Which Suricata keyword targets the TLS SNI field?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you want tls.sni because it matches the TLS SNI extension in the ClientHello, where the client tells the server the hostname it wants to reach. That lets you spot known malicious domains even when the session is encrypted HTTPS.
Full Explanation
The correct keyword is tls.sni. It is a sticky buffer that matches against the Server Name Indication extension in the TLS ClientHello message, which contains the hostname the client is trying to reach. That makes it useful for detecting malicious domains even over encrypted HTTPS. The http.host keyword is wrong because it targets the HTTP Host header in cleartext HTTP requests, not TLS SNI in encrypted connections. The dns.query keyword is wrong because it matches on DNS query names at the DNS protocol level, not TLS handshake fields. The ssl.cert_subject keyword is wrong because it matches the Subject field of the server's X.509 certificate, not the client's SNI request.