SOHO Hijack - Unauthorized External DNS Resolver (T1568.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•9

Identifies DNS queries sent to unauthorized external DNS resolvers (rogue IPs instead of corporate/ISP assigned servers).