This anomaly rule detects large HTTP POST requests that declare a body size of at least 1 MB and fail to receive a valid HTTP response (status 500) or have no response status recorded. Built for Suricata EVE JSON HTTP events, it parses the Content-Length header from http.request_headers to identify potential resource-exhaustion attempts or exploitation of vulnerable request handling (e.g., PHP2Shell). The rule aggregates data by source IP, destination IP, destination port, request URI, and HTTP method, reporting first/last seen times, maximum declared upload size, and observed status codes/user agents. It serves as a signal for follow-up correlation with web/application logs to determine malicious intent. False positives can occur from legitimate large file uploads, timeouts, or transient server issues; require investigation to distinguish abuse from normal operation. Recommended actions include validating the target URI and payload size, reviewing server and application logs for abnormal behavior, checking for PHP2Shell indicators in recent activity, and applying appropriate rate limits or blocking for repeated large uploads. The rule references relevant CVEs and MITRE technique T1190 to contextualize potential exploitation of publicly facing applications.