Subdomain Enumeration via High Volume DNS Queries

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects potential subdomain enumeration activity by identifying a high volume of DNS queries (100 queries within 30 seconds) originating from a single source IP address to port 53 (DNS) on the home network. This behavior is indicative of an attacker attempting to discover subdomains of a target domain.