rules/windows/registry_event/sysmon_dns_over_https_enabled.yml

title: DNS-over-HTTPS Enabled by Registry
id:04b45a8a-d11d-49e4-9acc-4a1b524407a5
description: Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
author: Austin Songer
status: experimental
references:
    - https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html
    - https://github.com/elastic/detection-rules/issues/1371
    - https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode
tags:
    - attack.defense_evasion
    - attack.t1140
logsource:
  product: windows
  category: registry_event
detection:
    selection1:
        TargetObject:
            - 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled'
	Details: 'DWORD (1)'
    selection2:
        TargetObject:
            - 'HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\DnsOverHttpsMode'
	Details: 'DWORD (secure)'
    condition: selection1 or selection2
falsepositives:
- "Unlikely"
level: "medium"
Create sysmon_dns_over_https_enabled.yml 2021-07-22 11:04:15 -05:00			`title: DNS-over-HTTPS Enabled by Registry`
			`id:04b45a8a-d11d-49e4-9acc-4a1b524407a5`
			`description: Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.`
			`author: Austin Songer`
			`status: experimental`
			`references:`
			`- https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html`
			`- https://github.com/elastic/detection-rules/issues/1371`
Update sysmon_dns_over_https_enabled.yml 2021-07-22 11:05:54 -05:00			`- https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode`
Create sysmon_dns_over_https_enabled.yml 2021-07-22 11:04:15 -05:00			`tags:`
			`- attack.defense_evasion`
Update sysmon_dns_over_https_enabled.yml 2021-07-22 11:05:54 -05:00			`- attack.t1140`
Create sysmon_dns_over_https_enabled.yml 2021-07-22 11:04:15 -05:00			`logsource:`
			`product: windows`
			`category: registry_event`
			`detection:`
			`selection1:`
			`TargetObject:`
			`- 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled'`
Update sysmon_dns_over_https_enabled.yml 2021-07-22 11:05:31 -05:00			`Details: 'DWORD (1)'`
Create sysmon_dns_over_https_enabled.yml 2021-07-22 11:04:15 -05:00			`selection2:`
			`TargetObject:`
			`- 'HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\DnsOverHttpsMode'`
Update sysmon_dns_over_https_enabled.yml 2021-07-22 11:05:31 -05:00			`Details: 'DWORD (secure)'`
Create sysmon_dns_over_https_enabled.yml 2021-07-22 11:04:15 -05:00			`condition: selection1 or selection2`
			`falsepositives:`
			`- "Unlikely"`
			`level: "medium"`