Windows Registry Changes Enabling DNS-over-HTTPS via Edge, Chrome, or Firefox Policies

title: Windows Registry Changes Enabling DNS-over-HTTPS via Edge, Chrome, or Firefox Policies
id: 60ae9541-9785-408b-b8c1-b2de0aa74579
status: test
description: This rule flags Windows registry policy settings that enable DNS-over-HTTPS in Microsoft Edge, Google Chrome, or Mozilla Firefox. Enabling DoH can reduce visibility into DNS query behavior and complicate detection of malicious activity such as data exfiltration or stealthy network usage. Telemetry is based on registry set events matching specific policy keys and values for each browser.
references:
  - https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html
  - https://github.com/elastic/detection-rules/issues/1371
  - https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode
  - https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml
author: Austin Songer, Huntrule Team
date: 2021-07-22
modified: 2023-08-17
tags:
  - attack.persistence
  - attack.stealth
  - attack.defense-impairment
  - attack.t1140
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection_edge:
    TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled
    Details: DWORD (0x00000001)
  selection_chrome:
    TargetObject|endswith: \SOFTWARE\Google\Chrome\DnsOverHttpsMode
    Details: secure
  selection_firefox:
    TargetObject|endswith: \SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled
    Details: DWORD (0x00000001)
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 04b45a8a-d11d-49e4-9acc-4a1b524407a5
    type: derived