Lion Cipher Lab
Detect DNS-over-HTTPS command-and-control tunneling
- SOC Analyst / Blue Team
- Advanced
- ~55 min
- Free · no account required
Why it matters
DNS tunneling is one of the most abused covert channels there is, and the classic detection reads the DNS query names out of a log. DNS-over-HTTPS breaks that detection on purpose: it hides the query inside an ordinary-looking HTTPS session to a resolver like Cloudflare or Google, so your dns.log is blind and the whole lab you did on dns.log stops working. Attackers know this — DoH-based C2 is a growing technique precisely because it inherits DNS tunneling's 'always allowed out' advantage while shedding its biggest weakness (visible queries). A SOC that can only hunt plaintext DNS has a hole…
What you'll learn
- explaining DNS-over-HTTPS (DoH, RFC 8484) and why it defeats DNS-query-based detection
- safely generating benign DoH traffic on your own machine with curl --doh-url (and Firefox TRR)
- capturing DoH with tshark/Zeek and confirming the DNS query names are NOT visible
- destination-intelligence detection: keying on the TLS SNI in Zeek ssl.log (server_name) plus known public DoH resolver IPs/hostnames
- alerting on DoH egress from processes/servers that should never do their own DNS
- behavioral/statistical detection: reading conn.log duration/orig_bytes/resp_bytes and beacon-periodicity to separate a beacon from human browsing
- using Mozilla's canary domain use-application-dns.net and enterprise policy to disable app-level DoH so it falls back to inspectable DNS
- measuring a detection against a benign browsing capture and reasoning about the false-positive rate
- naming the failure modes that break each angle: the legit-DoH base rate, ECH/ESNI hiding the SNI, JA3 collisions, and self-hosted resolvers
- judgment: when to reach for destination-intel vs behavioral detection, and when to just block everything except your own resolver
Steps in this lab
- What DoH is, and why it blinds DNS-query detection
- When to reach for which angle — and when NOT to bother
- Generate benign DoH on your own box — safely
- Angle A — destination intelligence and the SNI in ssl.log
- Angle A in practice — hunt ssl.log for DoH from the wrong hosts
- Angle B — behavioral beacon reasoning over conn.log
- Angle C — the canary domain and killing app-level DoH
- Measure it — run the detection against benign browsing
- The failure modes — where each angle breaks
- The judgment — pull the three angles together