ATT&CK T1499 - HTTP Flood Application DDoS

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects an HTTP flood application-layer Distributed Denial of Service (DDoS) attack. It triggers when a single source IP address sends 200 or more HTTP GET requests to a server within a 10-second window. This behavior is indicative of an attempt to overwhelm the application or server with a high volume of legitimate-looking HTTP requests.