HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAF

Overview

Azure Application Gateway Web Application Firewall (WAF) provides HTTP DDoS protection through the Microsoft HTTP DDoS Ruleset (Microsoft_HTTPDDoSRuleSet), which detects and mitigates volumetric HTTP-based attacks at the application layer. Unlike network-layer DDoS attacks that target bandwidth and infrastructure, HTTP-based DDoS attacks exploit the application layer by sending seemingly legitimate HTTP requests at extremely high volumes to exhaust server resources, database connections, and application threads.

Without HTTP DDoS protection enabled, threat actors can execute HTTP flood attacks that overwhelm backend servers with GET or POST requests at rates far exceeding normal traffic patterns, slowloris attacks that hold connections open by sending partial HTTP requests to exhaust connection pools, and high-frequency request patterns designed to trigger resource-intensive operations like complex database queries or file processing.

The HTTP DDoS ruleset contains rule groups like ExcessiveRequests with rules 500100 and 500110 that detect abnormal request rates based on configurable sensitivity levels (High, Medium, Low) and can block, log, or redirect malicious traffic. These rules identify clients making excessive requests within short time windows and can automatically block them before they impact application performance. By enabling this ruleset on Application Gateway WAF policies, malicious HTTP traffic is identified and blocked at the gateway before reaching backend application servers, preserving application availability and protecting infrastructure from resource exhaustion attacks.

Remediation

• What is Azure Web Application Firewall on Azure Application Gateway? - Overview of WAF capabilities on Application Gateway including DDoS protection rulesets
• Web Application Firewall CRS rule groups and rules - Documentation of available managed rulesets including HTTP DDoS rules
• Create Web Application Firewall policies for Application Gateway - Step-by-step guidance on creating and configuring WAF policies with managed rulesets
• Azure DDoS Protection overview - Overview of Azure DDoS Protection capabilities including application-layer protection

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Network
Category	Azure Network Security
Product	Azure
Feature	Network security
Area	Infrastructure hardening
ATT&CK	T1499.002 Service Exhaustion Flood, T1499.003 Application Exhaustion Flood
Licence	Azure WAF
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.