capa_reference_DNS_over_HTTPS_endpoints

YARA detection rule by markus.neis@swisscom.com / @markus_neis · Apache-2.0 License

reference DNS over HTTPS endpoints (converted from capa rule)

rule capa_reference_DNS_over_HTTPS_endpoints: CAPA {
  meta:
    description  = "reference DNS over HTTPS endpoints (converted from capa rule)"
    namespace    = "communication/dns"
    author       = "markus.neis@swisscom.com / @markus_neis"
    scope        = "file"
    references   = "https://github.com/curl/curl/wiki/DNS-over-HTTPS"
    hash         = "749e7becf00fccc6dff324a83976dc0d"
    reference    = "This YARA rule converted from capa rule: https://github.com/fireeye/capa-rules/blob/master/nursery/reference-dns-over-https-endpoints.yml"
    capa_nursery = "True"
    date         = "2021-05-17"
    minimum_yara = "3.8"
    license      = "Apache-2.0 License"

  strings:
    $re_bcg = /https:\/\/doh.seby.io:8443\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bch = /https:\/\/family.cloudflare-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bci = /https:\/\/free.bravedns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcj = /https:\/\/doh.familyshield.opendns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bck = /https:\/\/doh-de.blahdns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcl = /https:\/\/adblock.mydns.network\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcm = /https:\/\/bravedns.com\/configure.\\\{,1000\\\}/ nocase ascii wide
    $re_bcn = /https:\/\/cloudflare-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bco = /https:\/\/commons.host.\\\{,1000\\\}/ nocase ascii wide
    $re_bcp = /https:\/\/dns.aa.net.uk\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcq = /https:\/\/dns.alidns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcr = /https:\/\/dns-asia.wugui.zone\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcs = /https:\/\/dns.containerpi.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bct = /https:\/\/dns.containerpi.com\/doh\/family-filter\/.\\\{,1000\\\}/ nocase ascii wide
    $re_bcu = /https:\/\/dns.containerpi.com\/doh\/secure-filter\/.\\\{,1000\\\}/ nocase ascii wide
    $re_bcv = /https:\/\/dns.digitale-gesellschaft.ch\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcw = /https:\/\/dns.dnshome.de\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcx = /https:\/\/dns.dns-over-https.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcy = /https:\/\/dns.dnsoverhttps.net\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bcz = /https:\/\/dns.flatuslifir.is\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bda = /https:\/\/dnsforge.de\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdb = /https:\/\/dns.google\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdc = /https:\/\/dns.nextdns.io\/<config_id>.\\\{,1000\\\}/ nocase ascii wide
    $re_bdd = /https:\/\/dns.rubyfish.cn\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bde = /https:\/\/dns.switch.ch\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdf = /https:\/\/dns.twnic.tw\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdg = /https:\/\/dns.wugui.zone\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdh = /https:\/\/doh-2.seby.io\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdi = /https:\/\/doh.42l.fr\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdj = /https:\/\/doh.applied-privacy.net\/query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdk = /https:\/\/doh.armadillodns.net\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdl = /https:\/\/doh.captnemo.in\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdm = /https:\/\/doh.centraleu.pi-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdn = /https:\/\/doh.cleanbrowsing.org\/doh\/family-filter\/.\\\{,1000\\\}/ nocase ascii wide
    $re_bdo = /https:\/\/doh.crypto.sx\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdp = /https:\/\/doh.dnslify.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdq = /https:\/\/doh.dns.sb\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdr = /https:\/\/dohdot.coxlab.net\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bds = /https:\/\/doh.eastas.pi-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdt = /https:\/\/doh.eastau.pi-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdu = /https:\/\/doh.eastus.pi-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdv = /https:\/\/doh.ffmuc.net\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdw = /https:\/\/doh.libredns.gr\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdx = /https:\/\/doh.li\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdy = /https:\/\/doh.northeu.pi-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bdz = /https:\/\/doh.pi-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bea = /https:\/\/doh.powerdns.org.\\\{,1000\\\}/ nocase ascii wide
    $re_beb = /https:\/\/doh.tiarap.org\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bec = /https:\/\/doh.tiar.app\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bed = /https:\/\/doh.westus.pi-dns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bee = /https:\/\/doh.xfinity.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bef = /https:\/\/example.doh.blockerdns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_beg = /https:\/\/fi.doh.dns.snopyta.org\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_beh = /https:\/\/ibksturm.synology.me\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bei = /https:\/\/ibuki.cgnat.net\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bej = /https:\/\/jcdns.fun\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bek = /https:\/\/jp.tiarap.org\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bel = /https:\/\/jp.tiar.app\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_bem = /https:\/\/odvr.nic.cz\/doh.\\\{,1000\\\}/ nocase ascii wide
    $re_ben = /https:\/\/ordns.he.net\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_beo = /https:\/\/rdns.faelix.net\/.\\\{,1000\\\}/ nocase ascii wide
    $re_bep = /https:\/\/resolver-eu.lelux.fi\/dns-query.\\\{,1000\\\}/ nocase ascii wide
    $re_beq = /https:\/\/doh-jp.blahdns.com\/dns-query.\\\{,1000\\\}/ nocase ascii wide

  condition:
    capa_pe_file and
    (
      $re_bcg
      or $re_bch
      or $re_bci
      or $re_bcj
      or $re_bck
      or $re_bcl
      or $re_bcm
      or $re_bcn
      or $re_bco
      or $re_bcp
      or $re_bcq
      or $re_bcr
      or $re_bcs
      or $re_bct
      or $re_bcu
      or $re_bcv
      or $re_bcw
      or $re_bcx
      or $re_bcy
      or $re_bcz
      or $re_bda
      or $re_bdb
      or $re_bdc
      or $re_bdd
      or $re_bde
      or $re_bdf
      or $re_bdg
      or $re_bdh
      or $re_bdi
      or $re_bdj
      or $re_bdk
      or $re_bdl
      or $re_bdm
      or $re_bdn
      or $re_bdo
      or $re_bdp
      or $re_bdq
      or $re_bdr
      or $re_bds
      or $re_bdt
      or $re_bdu
      or $re_bdv
      or $re_bdw
      or $re_bdx
      or $re_bdy
      or $re_bdz
      or $re_bea
      or $re_beb
      or $re_bec
      or $re_bed
      or $re_bee
      or $re_bef
      or $re_beg
      or $re_beh
      or $re_bei
      or $re_bej
      or $re_bek
      or $re_bel
      or $re_bem
      or $re_ben
      or $re_beo
      or $re_bep
      or $re_beq
    )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b52600d7-c3cd-49f5-afbd-79c446d7c30b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion