ATT&CK T1499 - HTTP POST Flood DDoS

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•12

This rule detects a potential HTTP POST flood Distributed Denial of Service (DDoS) attack. It triggers an alert when a single source IP address sends 100 or more HTTP POST requests to the server within a 10-second window. This behavior is indicative of an attempt to overwhelm the server with requests, consuming resources and potentially leading to service disruption.