DNS-over-HTTPS Enabled by Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

Detects when a user enables DNS-over-HTTPS (DoH) by modifying specific registry keys for Microsoft Edge, Google Chrome, or Mozilla Firefox. Enabling DoH can obscure internet activity, potentially aiding in data exfiltration or evading network monitoring, as it encrypts DNS queries and bypasses traditional DNS visibility.