Suspicious DNS-over-HTTPS Enabled by Registry (via registry_set)

title: Suspicious DNS-over-HTTPS Enabled by Registry (via registry_set)
id: abc7e6a2-e4eb-5199-b133-362ba12ad4eb
status: stable
description: This rule detects when a user enables DNS-over-HTTPS. This can be leveraged to hide internet behavior or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are leveraged to determine bad actors.
references:
    - https://attack.mitre.org/techniques/T1112/
    - https://attack.mitre.org/techniques/T1140/
    - https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html
    - https://github.com/elastic/detection-rules/issues/1371
    - https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode
    - https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS
author: Huntrule Team
date: 2026-04-03
tags:
    - attack.persistence
    - attack.stealth
    - attack.defense-impairment
    - attack.t1140
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection_edge:
        TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled'
        Details: DWORD (0x00000001)
    selection_chrome:
        TargetObject|endswith: '\SOFTWARE\Google\Chrome\DnsOverHttpsMode'
        Details: 'secure'
    selection_firefox:
        TargetObject|endswith: '\SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled'
        Details: DWORD (0x00000001)
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium