diff --git a/rules/istio/ambient_upstream_timeout.yaml b/rules/istio/ambient_upstream_timeout.yaml
new file mode 100644
index 00000000..4330b4b9
--- /dev/null
+++ b/rules/istio/ambient_upstream_timeout.yaml
@@ -0,0 +1,7 @@
+name: istio_ambient_upstream_failure
+target: ztunnel
+conditions:
+  log_contains: "connection reset by peer"
+  http_status: 503
+severity: HIGH
+remediation: "Verify Istio Ambient mTLS certificate rotation and waypoint proxy reachability."