Real-time monitoring identifies an ICS Windows asset bypassing designated DNS resolvers, generating tunneling-like DNS content, or establishing HTTPS/TLS sessions to unapproved DoH resolver/API infrastructure from a process not authorized for encrypted DNS. Require a resolver-policy or asset-role violation plus suspicious query/content/process/destination evidence; suppress approved browsers, security products, vendor cloud services, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3; connection to DNS/DoH destination with process identity |
| Network Traffic Content (DC0085) | NSM:DNS | Native DNS query/response content: long/encoded labels, TXT use, unusual query structure |
| Network Traffic Flow (DC0078) | NSM:Flow | Direct external DNS or HTTPS/TLS flow bypassing designated resolver/proxy |
| Field | Description |
|---|---|
| ApprovedResolvers | Site DNS resolvers and forwarding architecture |
| ApprovedDoHProviders | Explicitly permitted DoH/DoT endpoints, if any |
| AuthorizedDoHProcesses | Browsers/security/vendor software permitted to use encrypted DNS |
| QueryPattern | Length/entropy/type/frequency patterns used only as corroboration |
| NoExternalConnectivityRoleList | ICS assets that should not resolve/connect externally |
Real-time monitoring identifies ICS clients sending DNS directly to unauthorized resolvers, native DNS with tunneling characteristics, or HTTPS/TLS connections to known/identified DoH infrastructure that bypass the site resolver/proxy architecture. Alert on policy violation plus content/flow corroboration; do not alert solely on high DNS volume.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NetworkDevice:IDS | DoH/DoT identification, SNI/HTTP host when observable, DNS tunneling signatures |
| NSM:DNS | DNS query/response metadata and content | |
| Network Traffic Flow (DC0078) | NSM:Flow | Client-to-resolver or client-to-DoH endpoint flow |
| Field | Description |
|---|---|
| ApprovedResolvers | Authorized recursive resolvers/forwarders |
| ApprovedDoHProviders | Permitted encrypted DNS services |
| ApprovedCommunicationMatrix | Which ICS zones/assets may resolve externally |
| QueryPattern | Encoded/long labels, unusual types, entropy and periodicity as corroboration |
| KnownDoHEndpoints | Resolver/API destinations used to identify bypass |
Real-time monitoring identifies a Linux ICS asset bypassing designated DNS resolvers, producing tunneling-like native DNS, or connecting to unapproved DoH/DoT infrastructure from an unauthorized process/service. Require resolver-policy or asset-role violation plus corroborating process, query, or destination evidence; suppress approved package/vendor/security workflows.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | linux:osquery | socket_events to DNS/DoH/DoT destinations, where deployed |
| Network Traffic Content (DC0085) | NSM:DNS | Native DNS query/response content |
| Network Traffic Flow (DC0078) | NSM:Flow | External DNS/HTTPS/TLS flow bypassing approved resolver/proxy |
| Field | Description |
|---|---|
| ApprovedResolvers | Site DNS resolvers |
| ApprovedDoHProviders | Permitted encrypted DNS endpoints |
| AuthorizedProcesses | Services permitted to resolve externally |
| QueryPattern | Tunneling-like query characteristics as corroboration |
| NoExternalConnectivityRoleList | Assets with no legitimate external resolution |
Real-time monitoring identifies an embedded OT/IoT device sending DNS to a resolver not defined for its role, tunneling-like native DNS, or direct HTTPS/TLS to an unapproved DoH endpoint. Because many embedded devices have fixed communications, require deviation from the device-specific resolver/destination profile and corroborating query or destination evidence.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:TLS/HTTP | SNI/HTTP host or resolver endpoint identification when observable |
| NSM:DNS | Device DNS query/response content | |
| Network Traffic Flow (DC0078) | NSM:Flow | Device-to-resolver/DoH destination flow |
| Field | Description |
|---|---|
| DeviceResolverProfile | Expected DNS resolver(s) per device/model/site |
| ApprovedVendorDomains | Vendor/cloud domains required for operation |
| ApprovedDoHProviders | Permitted encrypted DNS, normally empty for fixed-function devices |
| NoExternalConnectivityRoleList | Devices that should not resolve externally |
| QueryPattern | Tunneling characteristics used as corroboration, not sole trigger |