SOHO Hijack - Router UPnP Exploitation (T1068)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Identifies local devices sending crafted UPnP requests to the local gateway to programmatically alter DNS settings. This rule specifically looks for UDP traffic on port 1900 (UPnP) originating from processes like curl.exe or powershell.exe, which could indicate an attempt to exploit router UPnP vulnerabilities for DNS hijacking.