# HTTP DDoS Protection Ruleset is Enabled in Application Gateway WAF
Azure Application Gateway Web Application Firewall (WAF) provides HTTP DDoS protection through the Microsoft HTTP DDoS Ruleset…
Source: https://maester.dev/docs/tests/ZTA.27015
## Overview
Azure Application Gateway Web Application Firewall (WAF) provides HTTP DDoS protection through the Microsoft HTTP DDoS Ruleset (Microsoft_HTTPDDoSRuleSet), which detects and mitigates volumetric HTTP-based attacks at the application layer. Unlike network-layer DDoS attacks that target bandwidth and infrastructure, HTTP-based DDoS attacks exploit the application layer by sending seemingly legitimate HTTP requests at extremely high volumes to exhaust server resources, database connections, and application threads.
Without HTTP DDoS protection enabled, threat actors can execute HTTP flood attacks that overwhelm backend servers with GET or POST requests at rates far exceeding normal traffic patterns, slowloris attacks that hold connections open by sending partial HTTP requests to exhaust connection pools, and high-frequency request patterns designed to trigger resource-intensive operations like complex database queries or file processing.
The HTTP DDoS ruleset contains rule groups like ExcessiveRequests with rules 500100 and 500110 that detect abnormal request rates based on configurable sensitivity levels (High, Medium, Low) and can block, log, or redirect malicious traffic. These rules identify clients making excessive requests within short time windows and can automatically block them before they impact application performance. By enabling this ruleset on Application Gateway WAF policies, malicious HTTP traffic is identified and blocked at the gateway before reaching backend application servers, preserving application availability and protecting infrastructure from resource exhaustion attacks.
## Remediation
- [What is Azure Web Application Firewall on Azure Application Gateway?](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview) - Overview of WAF capabilities on Application Gateway including DDoS protection rulesets
- [Web Application Firewall CRS rule groups and rules](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules) - Documentation of available managed rulesets including HTTP DDoS rules
- [Create Web Application Firewall policies for Application Gateway](https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag) - Step-by-step guidance on creating and configuring WAF policies with managed rulesets
- [Azure DDoS Protection overview](https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview) - Overview of Azure DDoS Protection capabilities including application-layer protection
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Network |
| Category | Azure Network Security |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Network security |
| Area | Infrastructure hardening |
| ATT&CK | [T1499.002](/docs/tests?mitre=T1499.002) Service Exhaustion Flood, [T1499.003](/docs/tests?mitre=T1499.003) Application Exhaustion Flood |
| Licence | Azure WAF |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.