High Volume Network Retries to Remote IP

Ankit Mehta@Secvyn

•updated Jun 12, 2026•0•0•1

This rule detects a high volume of network connection retries (more than 500 within a one-minute window) to a distinct remote IP address. This behavior can be indicative of a network denial-of-service (DoS) attack, where an attacker attempts to overwhelm a target by repeatedly trying to establish connections.