DNS-over-HTTPS Enabled by Registry

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Austin Songer
Source: github.com/SigmaHQ/sigma

Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Stealth	`T1140` Deobfuscate/Decode Files or Information
Defense Impairment	`T1112` Modify Registry

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: DNS-over-HTTPS Enabled by Registry
id: 04b45a8a-d11d-49e4-9acc-4a1b524407a5
status: test
description: |
    Detects when a user enables DNS-over-HTTPS.
    This can be used to hide internet activity or be used to hide the process of exfiltrating data.
    With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
references:
    - https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html
    - https://github.com/elastic/detection-rules/issues/1371
    - https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode
    - https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS
author: Austin Songer
date: 2021-07-22
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.stealth
    - attack.defense-impairment
    - attack.t1140
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection_edge:
        TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled'
        Details: DWORD (0x00000001)
    selection_chrome:
        TargetObject|endswith: '\SOFTWARE\Google\Chrome\DnsOverHttpsMode'
        Details: 'secure'
    selection_firefox:
        TargetObject|endswith: '\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled'
        Details: DWORD (0x00000001)
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_edge`

selection_edge:
    TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled'
    Details: DWORD (0x00000001)

Stage 2: `selection_chrome`

selection_chrome:
    TargetObject|endswith: '\SOFTWARE\Google\Chrome\DnsOverHttpsMode'
    Details: 'secure'

Stage 3: `selection_firefox`

selection_firefox:
    TargetObject|endswith: '\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled'
    Details: DWORD (0x00000001)

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`DWORD (0x00000001)` corpus 40 (sigma 36, chronicle 4) `secure` corpus 2 (sigma 1, elastic 1)	`field:"Details" kind:eq`
`TargetObject`	ends_with	`\SOFTWARE\Google\Chrome\DnsOverHttpsMode` corpus 2 (sigma 1, elastic 1) `\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled` corpus 2 (sigma 1, elastic 1) `\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled`	`field:"TargetObject" kind:ends_with`