High Rate HTTP 404 Flood - Directory Brute Force

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•7

This rule detects a high rate of HTTP GET requests that are likely resulting in 404 (Not Found) errors, indicative of a directory brute-force attack. The rule triggers if a single source IP makes 50 or more HTTP GET requests within a 10-second window, suggesting an automated attempt to discover hidden directories or files on a web server.