T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process

A process that is not a browser or a sanctioned resolver connecting to a public DNS-over-HTTPS provider on 443. Observed as the C2 name-resolution stage of an infostealer: the injected process resolved its command-and-control domain through dns.google over HTTPS so the lookup never appears in plaintext DNS a defender can inspect, then beaconed TLS to a freshly registered, Cloudflare-fronted domain. DoH by a system or user process — explorer.exe, rundll32.exe, a sideloaded launcher — is anomalous: legitimate DoH belongs to browsers and, where configured, the OS resolver. This rule keys on the destination endpoints of the major DoH providers seen in the wild and excludes the browsers and resolver services expected to use them, leaving the injected or masqueraded process. The C2 domain and its Cloudflare IPs rotate; the "non-browser process performing DoH" behaviour does not, which is why it is the durable half. Pair with the process-injection and side-loading rules from the same chain.

Intel context

This detection responds to live corpus signal — the intel below is what its ATT&CK techniques are exercising right now (recomputed September 18, 2026).

Technique	KEV CVEs	OSINT cites	Active families
T1071.004	0	0	—
T1573 Encrypted Channel	0	1	—

Threat reporting citing this technique

2021-01-27 · CERT-FR_1510 [CERT-FR] Sandworm intrusion set campaign targeting Centreon systems

Rule ID: 5702b1fe-63ed-52f7-ac91-70dc0dab4b9d
Status: experimental
Level: medium
Log source: category: network_connection · product: windows
Date: 2026-08-14
Modified: 2026-08-14
ATT&CK: T1071.004 , T1573 (signal rollup)
Canonical YAML: t1071-004-doh-resolver-non-browser-c2.yml

References

False positives

Applications with embedded DoH clients (some VPN clients, security agents, or telemetry libraries) that legitimately reach a public DoH provider. Baseline the resolving process per environment and allowlist known-good images rather than removing the destination list.
Enterprise resolvers or forwarders configured to use public DoH upstreams. Scope to endpoints and exclude the sanctioned resolver host.

Rule YAML

title: 'T1071.004 DNS-over-HTTPS Resolution from a Non-Browser Process'
id: '5702b1fe-63ed-52f7-ac91-70dc0dab4b9d'
status: 'experimental'
description: 'A process that is not a browser or a sanctioned resolver connecting to a public DNS-over-HTTPS provider on 443. Observed as the C2 name-resolution stage of an infostealer: the injected process resolved its command-and-control domain through dns.google over HTTPS so the lookup never appears in plaintext DNS a defender can inspect, then beaconed TLS to a freshly registered, Cloudflare-fronted domain. DoH by a system or user process — explorer.exe, rundll32.exe, a sideloaded launcher — is anomalous: legitimate DoH belongs to browsers and, where configured, the OS resolver. This rule keys on the destination endpoints of the major DoH providers seen in the wild and excludes the browsers and resolver services expected to use them, leaving the injected or masqueraded process. The C2 domain and its Cloudflare IPs rotate; the "non-browser process performing DoH" behaviour does not, which is why it is the durable half. Pair with the process-injection and side-loading rules from the same chain.'
references:
    - 'https://thrunt.me/research/2026-08-11-etherhiding-onchain-conversion-registry/'
    - 'https://attack.mitre.org/techniques/T1071/004/'
    - 'https://attack.mitre.org/techniques/T1573/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-14'
modified: '2026-08-14'
tags:
    - 'attack.command_and_control'
    - 'attack.t1071.004'
    - 'attack.t1573'
    - 'tlp.clear'
logsource:
    category: 'network_connection'
    product: 'windows'
detection:
    selection_doh:
        Initiated: true
        DestinationPort: 443
        DestinationIp:
            - '8.8.8.8'
            - '8.8.4.4'
            - '1.1.1.1'
            - '1.0.0.1'
            - '9.9.9.9'
            - '149.112.112.112'
            - '94.140.14.14'
            - '94.140.15.15'
    filter_expected:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
            - '\svchost.exe'
            - '\MsMpEng.exe'
            - '\backgroundTaskHost.exe'
    condition: 'selection_doh and not filter_expected'
falsepositives:
    - 'Applications with embedded DoH clients (some VPN clients, security agents, or telemetry libraries) that legitimately reach a public DoH provider. Baseline the resolving process per environment and allowlist known-good images rather than removing the destination list.'
    - 'Enterprise resolvers or forwarders configured to use public DoH upstreams. Scope to endpoints and exclude the sanctioned resolver host.'
level: 'medium'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1071-004-doh-resolver-non-browser-c2.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.