Slowloris Slow HTTP DoS Attack Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects a Slowloris Slow HTTP DoS attack. It triggers when a single source IP sends 100 HTTP GET requests within a 300-second window to the internal network. Slowloris attacks work by holding open many HTTP connections to a web server, eventually exhausting the server's connection pool and making it unavailable to legitimate users.