Detection rules › Sigma
DoT (DNS over TLS) activation (command)
Detects scenarios where an attacker attempts to enable DNS over TLS in order to evade detection for command and control purposes.
Known false positives
- Legitimate DoT activation by administrators
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: DoT (DNS over TLS) activation (command)
description: Detects scenarios where an attacker attempts to enable DNS over TLS in order to evade detection for command and control purposes.
references:
- https://techcommunity.microsoft.com/t5/networking-blog/dns-over-tls-available-to-windows-insiders/ba-p/3565859
- http://woshub.com/enable-dns-over-https-windows/
tags:
- attack.defense_evasion
- attack.command_and_control
- attack.t1071.004
author: mdecrevoisier
status: stable
logsource:
product: windows
category: process_creation
detection:
selection_baseline:
EventID: 4688
NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"
CommandLine|contains: add
selection_enable: # full command: "netsh dns add global dot=yes"
CommandLine|contains: 'dot=yes'
selection_add_server: # full command: "netsh dns add encryption server=<resolver_ip> dothost=: autoupgrade=yes"
CommandLine|contains: 'dothost='
condition: selection_baseline and (selection_enable OR selection_add_server)
falsepositives:
- Legitimate DoT activation by administrators
level: medium
Stages and Predicates
Stage 0: condition
selection_baseline and (selection_enable OR selection_add_server)Stage 1: selection_baseline
selection_baseline:
EventID: 4688
NewProcessName|endswith: '\netsh.exe'
CommandLine|contains: add
Stage 2: selection_enable
selection_enable:
CommandLine|contains: 'dot=yes'
Stage 3: selection_add_server
selection_add_server:
CommandLine|contains: 'dothost='
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\netsh.exe" |