PowerShell DNS over HTTPS (DoH) Activity
Detects PowerShell processes initiating network connections to known public DNS-over-HTTPS (DoH) providers over port 443. This behavior is often associated with efforts to bypass standard organizational DNS logging and security controls by tunnelng DNS queries through encrypted HTTPS traffic.
Microsoft Sentinel (KQL)
