Suricata

RFC 5321 states that a mid-session EHLO must be treated just like an RSET:

An EHLO command MAY be issued by a client later in the session. If
it is issued after the session begins and the EHLO command is
acceptable to the SMTP server, the SMTP server MUST clear all buffers
and reset the state exactly as if a RSET command had been issued. In
other words, the sequence of RSET followed immediately by EHLO is
redundant, but not harmful other than in the performance cost of
executing unnecessary commands.

Currently Suricata more or less just ignores it.