SOHO Hijack - Traffic to Rogue DNS Infrastructure
Flags traffic targeting known rogue DNS infrastructure IPs associated with recent SOHO router hijacking campaigns. This rule specifically looks for outbound network connections to IP addresses starting with '5.' or '185.' on destination port 53 (DNS).
Microsoft Sentinel (KQL)
