Rogue DNS Server Query Response Detected
This rule detects potential rogue DNS server activity by monitoring UDP traffic on port 53 (DNS) to the home network. It specifically looks for DNS query responses (indicated by the content "|84 80|") and triggers an alert if 20 such responses are observed from the same source IP within a 30-second window. This behavior could indicate an unauthorized or malicious DNS server attempting to respond to client queries.
Suricata
