New Local DNS Server Activity

A rogue DNS server is a powerful technique for directing victims to attacker-controlled servers. First, the attacker either gains access to a device on the network with admin privileges, or the attacker connects a new device, such as a Raspberry Pi, to a network through an ethernet cable or to a wireless network. Next, the attacker configures the device to store malicious domain records and act as a DNS server. Finally, the attacker employs various techniques that configure network clients to communicate with the rogue DNS server. When the client tries to resolve the domain name of a legitimate host, the rogue DNS server responds with the IP address for the attacker-controlled host. The client is now redirected to the malicious host, enabling the attacker to send malicious content to the client or trick users into revealing sensitive information.