title: Post-quantum protection lost on a monitored endpoint
id: d9914ca4-cb31-4ce9-a38c-3bbb9caa0df9
status: experimental
description: |
  A Sovereign Q sensor saw an endpoint that negotiated hybrid ML-KEM key exchange fall back to
  classical key exchange. Traffic from that point can be recorded now and decrypted later.
  Causes include a configuration change, a load balancer or CDN policy change, or a downgrade attack.
  Events come from `sovereign-q watch --jsonl` (one JSON object per line).
references:
  - https://sovereignsystemslabs.com/security/developers
author: Sovereign Systems Labs
date: 2026-11-02
tags:
  - attack.defense-evasion
  - attack.t1562.010
logsource:
  product: sovereign-q
  service: sensor
detection:
  selection:
    source: sovereign-q
    event: downgrade
  condition: selection
fields:
  - target
  - from
  - to
  - key_exchange
falsepositives:
  - A planned change to a load balancer, CDN or TLS library configuration
level: high