DoT (DNS over TLS) activation (PowerShell)

Status: experimental
Severity: medium
Log source: category ['ps_module', 'ps_classic_script', 'ps_script'], product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enable DNS over TLS in order to evade detection for command and control purposes.

Known false positives

Legitimate DoT activation by administrators

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071.004` Application Layer Protocol: DNS

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule body

title: DoT (DNS over TLS) activation (PowerShell)
description: Detects scenarios where an attacker attempts to enable DNS over TLS in order to evade detection for command and control purposes.
references:
- https://techcommunity.microsoft.com/t5/networking-blog/dns-over-tls-available-to-windows-insiders/ba-p/3565859
- http://woshub.com/enable-dns-over-https-windows/
tags:
- attack.defense_evasion
- attack.command_and_control
- attack.t1071.004 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - '-ItemProperty' # Can be New-* or Set-*
      - '\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters'
      - 'EnableAutoDoh'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - '-ItemProperty' # Can be New-* or Set-*
      - '\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters'
      - 'EnableAutoDoh'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - '-ItemProperty' # Can be New-* or Set-*
      - '\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters'
      - 'EnableAutoDoh'

  condition: 1 of selection*
falsepositives:
- Legitimate DoT activation by administrators 
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection_powershell_native`

selection_powershell_native:
  EventID: 800
  EventData|contains|all:
    - '-ItemProperty'
    - '\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters'
    - 'EnableAutoDoh'

Stage 2: `selection_powershell_modern`

selection_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - '-ItemProperty'
    - '\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters'
    - 'EnableAutoDoh'

Stage 3: `selection_powershell_block`

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - '-ItemProperty'
    - '\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters'
    - 'EnableAutoDoh'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`-ItemProperty` corpus 5 (sigma 5) `EnableAutoDoh` `\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters`	`field:"EventData" kind:match`
`Payload`	match	`-ItemProperty` corpus 5 (sigma 5) `EnableAutoDoh` `\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters`	`field:"Payload" kind:match`
`ScriptBlockText`	match	`-ItemProperty` corpus 5 (sigma 5) `EnableAutoDoh` `\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters`	`field:"ScriptBlockText" kind:match`

DoT (DNS over TLS) activation (PowerShell)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_powershell_native

Stage 2: selection_powershell_modern

Stage 3: selection_powershell_block

Indicators

Stage 0: `condition`

Stage 1: `selection_powershell_native`

Stage 2: `selection_powershell_modern`

Stage 3: `selection_powershell_block`