You haven't mentioned an OS, and this isn't what you asked for (a rewriterule) -- but it does block attacks.
I use Fail2Ban to block all kinds of junk on Ubuntu; using the webserver log, the sshd log and others.
An incident = a regexp + a log file.
A rule can say when there are NN incidents in time T add a ban in the firewall for the IP for X minutes. The default is like 10 minutes... which is good if you accidentally ban yourself. If you are not worried about that, it can be set longer.
The nice thing about this approach is that you can ban all traffic from that IP and not just traffic against the web server. Also, instead of getting an indication like REFUSED or FORBIDDEN, the traffic can simply hang and never be delivered or acknowledged.