An common L7 DDoS mechanism we've seen is a small number of IP's attempting garbage login attempts at relatively low-rates which often elude rate-limiting. A relatively small number of bot IP's performing logins at the same time can consume resources and db connections and cause failures in the application.

The now legacy brute-force login detection could be effective by temporarily blocking IP addresses that exceed some preconfigured threshold of failures. Bonus for checking a list of compromised credentials being used.

Alternatively, designating "sensitive" paths in the application with queuing/waiting room functionality could be effective if a global limit could be applied (and not per-RE) - e.g. no more than 20 instances with outstanding responses.

This because another attack variant I've from DDoS attacks I've seen is sending very complicated searches into unauthenticated search forms; multiply by 2,000 IP's, sites can be quickly overwhelmed.