Potential DNS Rebinding from Public to Private Address

Description

Identifies a client resolving the same public registered domain to both a public IP address and a private, loopback, link-local, unique-local IPv6, or shared address. This includes both address classes being observed at the same timestamp, and a public answer followed within five minutes by a private answer where the minimum TTL across all answer records in the private-answer events is 60 seconds or less. Either pattern is consistent with DNS rebinding that pivots browser or application trust to internal resources.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Detection requirements

Platform: Identity Provider Linux macOS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

Split-horizon DNS, VPN transitions, service discovery, failover, hairpin NAT, and dual-stack names that publish a public A record with a unique-local AAAA record can legitimately produce public and private answers for the same name. Recursive resolvers, DNS forwarders, and localhost listeners can also aggregate many endpoints under one client address. Security products may sinkhole suspicious domains to loopback or private addresses with short TTLs. Confirm the domain, resolver placement, and client identity before adding an exception, and scope exceptions by registered domain or client rather than globally.

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
owasp.org/www-community/attacks/DNS_Rebinding	Unclassified	Only this detection cites it
portswigger.net/web-security/ssrf	Unclassified	Only this detection cites it

Detection rules

Potential DNS Rebinding from Public to Private Address

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules