diff --git a/doc/userguide/rules/app-layer.rst b/doc/userguide/rules/app-layer.rst
index 330b38cf75..e72fc64393 100644
--- a/doc/userguide/rules/app-layer.rst
+++ b/doc/userguide/rules/app-layer.rst
@@ -18,11 +18,15 @@ Examples::
     app-layer-protocol:!http,final;
     app-layer-protocol:http,to_server; app-layer-protocol:tls,to_client;
     app-layer-protocol:http2,final; app-layer-protocol:http1,original;
+    app-layer-protocol:unknown;
 
 A special value 'failed' can be used for matching on flows in which
 protocol detection failed. This can happen if Suricata doesn't know
 the protocol or when certain 'bail out' conditions happen.
 
+A special value 'unknown' can be used to match on a protocol being
+not yet known. It can not be negated.
+
 The different modes are
 * direction : protocol recognized on the direction of the current packet
 * to_server : protocol recognized in the direction to server
@@ -33,6 +37,9 @@ The different modes are
 
 By default, (if no mode is specified), the mode is ``direction``.
 
+.. note:: when negation is used, like ``!http``, it will not match on the
+   "unknown" state in the flow.
+
 Here is an example of a rule matching non-http traffic on port 80:
 
 .. container:: example-rule
diff --git a/src/detect-app-layer-protocol.c b/src/detect-app-layer-protocol.c
index b95d099db5..071a3ee939 100644
--- a/src/detect-app-layer-protocol.c
+++ b/src/detect-app-layer-protocol.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2022 Open Information Security Foundation
+/* Copyright (C) 2007-2025 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -77,41 +77,70 @@ static int DetectAppLayerProtocolPacketMatch(
 
     switch (data->mode) {
         case DETECT_ALPROTO_DIRECTION:
-            if (p->flowflags & FLOW_PKT_TOSERVER) {
-                if (f->alproto_ts == ALPROTO_UNKNOWN)
-                    SCReturnInt(0);
-                r = AppProtoEquals(data->alproto, f->alproto_ts);
+            if (data->negated) {
+                if (p->flowflags & FLOW_PKT_TOSERVER) {
+                    if (f->alproto_ts == ALPROTO_UNKNOWN)
+                        SCReturnInt(0);
+                    r = AppProtoEquals(data->alproto, f->alproto_ts);
+                } else {
+                    if (f->alproto_tc == ALPROTO_UNKNOWN)
+                        SCReturnInt(0);
+                    r = AppProtoEquals(data->alproto, f->alproto_tc);
+                }
             } else {
-                if (f->alproto_tc == ALPROTO_UNKNOWN)
-                    SCReturnInt(0);
-                r = AppProtoEquals(data->alproto, f->alproto_tc);
+                if (p->flowflags & FLOW_PKT_TOSERVER) {
+                    r = AppProtoEquals(data->alproto, f->alproto_ts);
+                } else {
+                    r = AppProtoEquals(data->alproto, f->alproto_tc);
+                }
             }
             break;
         case DETECT_ALPROTO_ORIG:
-            if (f->alproto_orig == ALPROTO_UNKNOWN)
-                SCReturnInt(0);
-            r = AppProtoEquals(data->alproto, f->alproto_orig);
+            if (data->negated) {
+                if (f->alproto_orig == ALPROTO_UNKNOWN)
+                    SCReturnInt(0);
+                r = AppProtoEquals(data->alproto, f->alproto_orig);
+            } else {
+                r = AppProtoEquals(data->alproto, f->alproto_orig);
+            }
             break;
         case DETECT_ALPROTO_FINAL:
-            if (f->alproto == ALPROTO_UNKNOWN)
-                SCReturnInt(0);
-            r = AppProtoEquals(data->alproto, f->alproto);
+            if (data->negated) {
+                if (f->alproto == ALPROTO_UNKNOWN)
+                    SCReturnInt(0);
+                r = AppProtoEquals(data->alproto, f->alproto);
+            } else {
+                r = AppProtoEquals(data->alproto, f->alproto);
+            }
             break;
         case DETECT_ALPROTO_TOSERVER:
-            if (f->alproto_ts == ALPROTO_UNKNOWN)
-                SCReturnInt(0);
-            r = AppProtoEquals(data->alproto, f->alproto_ts);
+            if (data->negated) {
+                if (f->alproto_ts == ALPROTO_UNKNOWN)
+                    SCReturnInt(0);
+                r = AppProtoEquals(data->alproto, f->alproto_ts);
+            } else {
+                r = AppProtoEquals(data->alproto, f->alproto_ts);
+            }
             break;
         case DETECT_ALPROTO_TOCLIENT:
-            if (f->alproto_tc == ALPROTO_UNKNOWN)
-                SCReturnInt(0);
-            r = AppProtoEquals(data->alproto, f->alproto_tc);
+            if (data->negated) {
+                if (f->alproto_tc == ALPROTO_UNKNOWN)
+                    SCReturnInt(0);
+                r = AppProtoEquals(data->alproto, f->alproto_tc);
+            } else {
+                r = AppProtoEquals(data->alproto, f->alproto_tc);
+            }
             break;
         case DETECT_ALPROTO_EITHER:
-            if (f->alproto_ts == ALPROTO_UNKNOWN && f->alproto_tc == ALPROTO_UNKNOWN)
-                SCReturnInt(0);
-            r = AppProtoEquals(data->alproto, f->alproto_tc) ||
-                AppProtoEquals(data->alproto, f->alproto_ts);
+            if (data->negated) {
+                if (f->alproto_ts == ALPROTO_UNKNOWN && f->alproto_tc == ALPROTO_UNKNOWN)
+                    SCReturnInt(0);
+                r = AppProtoEquals(data->alproto, f->alproto_tc) ||
+                    AppProtoEquals(data->alproto, f->alproto_ts);
+            } else {
+                r = AppProtoEquals(data->alproto, f->alproto_tc) ||
+                    AppProtoEquals(data->alproto, f->alproto_ts);
+            }
             break;
     }
     r = r ^ data->negated;
@@ -138,6 +167,13 @@ static DetectAppLayerProtocolData *DetectAppLayerProtocolParse(const char *arg,
     }
     if (strcmp(alproto_name, "failed") == 0) {
         alproto = ALPROTO_FAILED;
+    } else if (strcmp(alproto_name, "unknown") == 0) {
+        if (negate) {
+            SCLogError("app-layer-protocol "
+                       "keyword can't use negation with protocol 'unknown'");
+            return NULL;
+        }
+        alproto = ALPROTO_UNKNOWN;
     } else {
         alproto = AppLayerGetProtoByName(alproto_name);
         if (alproto == ALPROTO_UNKNOWN) {
@@ -293,19 +329,32 @@ PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const vo
         case DETECT_ALPROTO_EITHER:
             // check if either protocol toclient or toserver matches
             // the one in the signature ctx
-            if (f->alproto_tc != ALPROTO_UNKNOWN &&
-                    AppProtoEquals(ctx->v1.u16[0], f->alproto_tc) ^ negated) {
-                PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
-            } else if (f->alproto_ts != ALPROTO_UNKNOWN &&
-                       AppProtoEquals(ctx->v1.u16[0], f->alproto_ts) ^ negated) {
-                PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+            if (negated) {
+                if (f->alproto_tc != ALPROTO_UNKNOWN &&
+                        !AppProtoEquals(ctx->v1.u16[0], f->alproto_tc)) {
+                    PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+                } else if (f->alproto_ts != ALPROTO_UNKNOWN &&
+                           !AppProtoEquals(ctx->v1.u16[0], f->alproto_ts)) {
+                    PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+                }
+            } else {
+                if (AppProtoEquals(ctx->v1.u16[0], f->alproto_tc) ||
+                        AppProtoEquals(ctx->v1.u16[0], f->alproto_ts)) {
+                    PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+                }
             }
             // We return right away to avoid calling PrefilterAddSids again
             return;
     }
 
-    if (alproto != ALPROTO_UNKNOWN) {
-        if (AppProtoEquals(ctx->v1.u16[0], alproto) ^ negated) {
+    if (negated) {
+        if (alproto != ALPROTO_UNKNOWN) {
+            if (!AppProtoEquals(ctx->v1.u16[0], alproto)) {
+                PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
+            }
+        }
+    } else {
+        if (AppProtoEquals(ctx->v1.u16[0], alproto)) {
             PrefilterAddSids(&det_ctx->pmq, ctx->sigs_array, ctx->sigs_cnt);
         }
     }