DNS Reverse Lookup Sweep Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a DNS reverse lookup sweep, which is characterized by a high volume of DNS queries for reverse IP addresses (in-addr.arpa) within a short period. Specifically, it triggers an alert if 20 such queries are observed from a single source IP within 30 seconds. This activity is often indicative of reconnaissance efforts by an attacker to map out internal network infrastructure.