Detects DNS rebinding activity by monitoring DNS responses for the same client and fully qualified domain name (FQDN) that resolve to both public and internal addresses (including RFC1918, loopback, link-local, unique-local IPv6, or shared addresses). The rule flags two patterns: (1) public and private address observations with the same timestamp, or (2) a public answer followed within five minutes by a private answer where the minimum TTL across all private-answer records is 60 seconds or less. This correlation relies on dns.question.name, dns.question.registered_domain, and dns.resolved_ip, along with TTL data from dns.answers, to compute Esql fields such as Esql.client_ip, Esql.public_ip, Esql.private_ip, and timing fields. The result highlights potential DNS rebinding that could pivot trust to internal resources, typically used to reach internal services from a victim client. MITRE ATT&CK mapping emphasizes Initial Access (Drive-by Compromise). The rule is designed to operate with network traffic sources (DNS events) from Elastic Network Traffic and Zeek DNS integrations, enabling cross-sensor correlation while presenting triage data for investigation.