SOHO Hijack - Malicious DNS Resolution of Core Services (T1568.002)
Detects a device attempting to resolve a legitimate Microsoft/Banking domain, but receiving a non-standard/malicious IP indicative of router-level DNS hijacking.
Microsoft Sentinel (KQL)
