High HTTP/2 Header Count (HTTP/2 Bomb Amplification)

Identifies HTTP/2 requests with excessive header counts to detect the memory amplification stage of an HTTP/2 Bomb DoS attack.

Microsoft Sentinel (KQL)