title: 'T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process'
id: '5702b1fe-63ed-52f7-ac91-70dc0dab4b9d'
status: 'experimental'
description: 'A process that is not a browser or a sanctioned resolver connecting to a public DNS-over-HTTPS provider on 443. Observed as the C2 name-resolution stage of an infostealer: the injected process resolved its command-and-control domain through dns.google over HTTPS so the lookup never appears in plaintext DNS a defender can inspect, then beaconed TLS to a freshly registered, Cloudflare-fronted domain. DoH by a system or user process — explorer.exe, rundll32.exe, a sideloaded launcher — is anomalous: legitimate DoH belongs to browsers and, where configured, the OS resolver. This rule keys on the destination endpoints of the major DoH providers seen in the wild and excludes the browsers and resolver services expected to use them, leaving the injected or masqueraded process. The C2 domain and its Cloudflare IPs rotate; the "non-browser process performing DoH" behaviour does not, which is why it is the durable half. Pair with the process-injection and side-loading rules from the same chain.'
references:
    - 'https://thrunt.me/research/2026-08-11-etherhiding-onchain-conversion-registry/'
    - 'https://attack.mitre.org/techniques/T1071/004/'
    - 'https://attack.mitre.org/techniques/T1573/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-14'
modified: '2026-08-14'
tags:
    - 'attack.command_and_control'
    - 'attack.t1071.004'
    - 'attack.t1573'
    - 'tlp.clear'
logsource:
    category: 'network_connection'
    product: 'windows'
detection:
    selection_doh:
        Initiated: true
        DestinationPort: 443
        DestinationIp:
            - '8.8.8.8'
            - '8.8.4.4'
            - '1.1.1.1'
            - '1.0.0.1'
            - '9.9.9.9'
            - '149.112.112.112'
            - '94.140.14.14'
            - '94.140.15.15'
    filter_expected:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
            - '\svchost.exe'
            - '\MsMpEng.exe'
            - '\backgroundTaskHost.exe'
    condition: 'selection_doh and not filter_expected'
falsepositives:
    - 'Applications with embedded DoH clients (some VPN clients, security agents, or telemetry libraries) that legitimately reach a public DoH provider. Baseline the resolving process per environment and allowlist known-good images rather than removing the destination list.'
    - 'Enterprise resolvers or forwarders configured to use public DoH upstreams. Scope to endpoints and exclude the sanctioned resolver host.'
level: 'medium'