Rare Non-Browser Executable Making Direct Google DoH Connections
Detects unusual executables that are not recognized web browsers initiating direct network connections to Google DNS-over-HTTPS (DoH) services. This behavior is often associated with malware attempting to bypass local DNS resolution to communicate with command-and-control servers covertly.
Microsoft Sentinel (KQL)
