Rule Category


Alert Message

POLICY-OTHER SSL/TLS weak RC4 cipher suite use attempt

Rule Explanation

This event is generated when a weak SSL/TLS RC4 cipher suite is detected. Impact: Potential Corporate Privacy Violation Details: Ease of Attack:

What To Look For

This rule alerts when an attempt to enumerate weak cipher suites is being performed.

Known Usage

No public information

False Positives

No known false positives


Cisco Talos Intelligence Group

Rule Groups

No rule groups


Rule Vulnerability


Not Applicable

CVE Additional Information

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
SeverityMEDIUM Base Score4.3
Impact Score2.9 Exploit Score8.6
Confidentiality ImpactPARTIAL Integrity ImpactNONE
Availability ImpactNONE Access Vector
AuthenticationNONE Ease of Access