Detects two ALPN-based denial-of-service patterns against TLS servers: (1) repeated stalled TLS handshakes where the ClientHello advertises acme-tls/1 as the ALPN protocol and the handshake never completes (tls.established == false), indicating potential goroutine or worker exhaustion in reverse proxies. (2) connections in which a malformed ALPN extension triggers TLS alerts such as decode_error or illegal_parameter, consistent with zero-length ALPN list exploitation. Both patterns are anomalous outside of scheduled ACME TLS-ALPN-01 certificate validation activity. The rule fires when five or more such events originate from the same source IP to the same destination IP within the detection window. The detection logic aggregates by source/destination, captures top destination ports, network_community_id, ALPN values, and alert types, and requires event_count >= 5. For investigation, correlate with network_traffic.flow to obtain bytes and duration; review server-side metrics for saturation (goroutine counts, worker/thread counts, TCP accept queue depth); and verify patch status for CVE-2026-22045. False positives include legitimate ACME renewal clients (cert-manager, Certbot, Caddy) using acme-tls/1 during TLS-ALPN-01; a single incomplete challenge is normal. Misconfigurations such as load balancer health checks can also trigger this pattern. Remediation includes blocking non-authorized sources, applying TLS handshake timeout patches (e.g., Traefik, nginx), enforcing listener-level handshake timeouts, rate-limiting inbound TLS connections per source, and restarting affected services if degradation is observed.