Non-Browser Process DoH Provider Connection on Port 443 (T1071.004)

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•2

This rule detects network connections on port 443 made to common public DNS resolvers (1.1.1.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 149.112.112.112) by processes other than known web browsers. This behavior is atypical for standard endpoint processes and may indicate the use of DNS-over-HTTPS (DoH) for command and control or data exfiltration to bypass network filtering.