ATT&CK T1016 - Rapid DNS Queries for Network Recon

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects a high rate of DNS queries from a single source IP address to the local network (HOME_NET) on UDP port 53. Specifically, it triggers an alert if more than 100 DNS queries are observed from the same source within a 10-second window. This behavior is indicative of network reconnaissance, where an attacker might be rapidly querying DNS to map out internal network resources or identify potential targets.