HTTP error burst
Detects a burst of failed HTTP requests (4xx/5xx) from one client IP in a short window — the signature of web vulnerability scanning, directory / file…
What it detects
Detects a burst of failed HTTP requests (4xx/5xx) from one client IP in a short window — the signature of web vulnerability scanning, directory / file brute-forcing, or credential stuffing against a web application. Uses the outcome the web access-log parser derives from the HTTP status, so it works on any imported Apache/Nginx log.
MITRE ATT&CK mapping
False positives and triage
Health checks, uptime monitors, link checkers, and misconfigured clients can generate repeated 4xx. Confirm the source IP is external / untrusted and the requests look like scanning — many distinct 404s, admin-panel probes, or known exploit paths — rather than one broken client retrying a single URL.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/web/http_error_burst.yaml, licensed under the Apache License 2.0.
id: web.recon.http_error_burst
version: 1.0.0
status: experimental
severity: medium
confidence: 0.6
platforms: [windows, linux, macos]
mitre_techniques: [T1595, T1110]
description: |
Detects a burst of failed HTTP requests (4xx/5xx) from one client IP in a short
window — the signature of web vulnerability scanning, directory / file brute-forcing,
or credential stuffing against a web application. Uses the outcome the web access-log
parser derives from the HTTP status, so it works on any imported Apache/Nginx log.
match:
event_category: network
event_action: http_request
event_outcome: failure
threshold:
count: 15
window_seconds: 300
group_by: [source_ip]
correlation_keys: [source_ip]
false_positive_guidance: |
Health checks, uptime monitors, link checkers, and misconfigured clients can generate
repeated 4xx. Confirm the source IP is external / untrusted and the requests look like
scanning — many distinct 404s, admin-panel probes, or known exploit paths — rather than
one broken client retrying a single URL.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.