APT28 Rogue DNS Server Registry Modification via Tcpip Interfaces Key
Detects modifications to Windows Registry keys responsible for network interface DNS configuration (NameServer or DhcpNameServer) where a non-corporate, non-private, and non-loopback DNS server is set. This behavior may indicate an attempt to intercept or redirect network traffic, potentially for command and control or man-in-the-middle operations.
Microsoft Sentinel (KQL)
