DNS Hijacking via Compromised Resolver

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.