161. Adversaries Leverage DNS over HTTPS (DoH) to Evade Detection
Hello everyone! Let's look at a curious example of Protocol Tunneling technique (T1572) as seen in a recent report by SentinelOne. The adversary used a ShadowPad variant, which leveraged DNS over HTTPS (DoH) in an attempt to evade detection. In order to obscure DNS traffic, the threat actors Base-64 encoded queried domains, for example: https://8.8.8.8:443/dns-query?dns=AAABAAABAAAAAAAABG5ld3MKaW1hZ2luZXJqcANjb20AAAEAAQ So, if you have related telemetry - you know what to hunt for! See you tomorrow!