Detection of DoH traffic to known DoH-providers
This query identifies network traffic to well-known DoH endpoints (e.g., Cloudflare, Google, Quad9, Mozilla). DoH encrypts DNS requests inside HTTPS, which enhances privacy but creates blind spots for defenders. Adversaries can exploit DoH to bypass DNS-based filtering, hide access to phishing domains, establish stealthy command-and-control channels, or exfiltrate data without triggering traditional DNS logs. Monitoring and alerting on DoH connections helps restore visibility into DNS activity—one of the most critical layers of network defense.
#event_simpleName = DnsRequest
| in(field="DomainName", values=["cloudflare-dns.com", "dns.google", "dns.quad9.net","mozilla.cloudflare-dns.com"])
| groupBy(["ComputerName","ContextBaseFileName"])DNS over HTTPS (DoH) encrypts DNS queries by tunneling them through HTTPS, making them indistinguishable from regular web traffic. While this improves user privacy, it also introduces blind spots for security teams. Why it matters: - Phishing domains can be accessed without triggering DNS-based filtering. - Command-and-Control (C2) communication can blend into normal HTTPS traffic. - Data exfiltration becomes harder to detect as destination domains are hidden. Impact on organizations: Without proper monitoring or controls, DoH can undermine DNS visibility—one of the most critical layers in network security—allowing threats to go unnoticed.
