Potential Web Application DoS or Reconnaissance Attempt

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•3

This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.