SignalHunt
← All rules

WAF-5004

medium

Repeated WAF Blocks From the Same Source (Scanning/Probing)

Detects a burst of blocked requests from the same source IP regardless of attack type - a source trying many different signatures in a short window is behaving like an automated scanner, not a one-off mistake.

T1595

Detection logic

{
  "detection_type": "threshold",
  "selection": {
    "action": "block"
  },
  "groupby": "src_ip",
  "timeframe_minutes": 5,
  "threshold": 5,
  "condition": "gte"
}

Log source: category=waf · Event ID(s): waf_block

Required log fields

  • src_ip

Enabling this in your environment

Where: WAF logging - ensure blocked-request logs are shipped with source IP intact (not lost behind an upstream proxy/CDN without X-Forwarded-For preserved).

n/a - log shipping configuration, not a policy toggle

If requests pass through a CDN/load balancer before the WAF, confirm the WAF is logging the real client IP and not the load balancer's address for every request - otherwise this rule groups everything under one IP and is useless.

False positives

  • A shared corporate NAT/proxy IP where one misbehaving internal client (broken scanner, misconfigured integration test) trips several signatures

References