Possible Brute Force or Directory Traversal via HTTP POST

Jorden Smith@Jorden

•updated Feb 10, 2026•0•51

This rule detects potential suspicious activity by identifying internal hosts making frequent HTTP POST requests to external IP addresses (excluding RFC1918 and localhost ranges) over the Tor network (indicated by 'index=onion'). It counts the number of such requests from each originating host to a responding host and flags connections with 5 or more POST requests, along with the URIs and user agents involved.