DoH Beaconing to Known Resolver IPs by Non-Browser Processes
Detects outbound network connections to well-known public DNS-over-HTTPS (DoH) providers (e.g., Google, Cloudflare, Quad9) from processes other than standard web browsers. This behavior is often associated with adversary attempts to bypass local DNS monitoring or security controls by tunnelled traffic over HTTPS.
Microsoft Sentinel (KQL)
