DNS-over-HTTPS resolver bypass

exfil_doh_resolution

Resolves a known-bad test domain through public DNS-over-HTTPS resolvers instead of the host's configured resolver, to establish whether DNS filtering can simply be walked around by any application that speaks HTTPS.

Severity high how bad it would be if it were real

Expected outcome Something should prevent it

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1071.004	DNS	Command and Control	coverage statistics
T1573	Encrypted Channel	Command and Control	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other exfiltration tests

Other tests in the Exfiltration category.
Test	What it does	Severity
Upload to consumer cloud storage exfil_cloud_storage_upload	Attempts to upload a synthetic-PII canary to Dropbox, Google Drive, OneDrive, an anonymous file drop and a paste site, using deliberately invalid cred…	high
DNS tunnelling pattern exfil_dns_tunnel	Issues a burst of long, high-entropy subdomain lookups under a controlled zone — the shape of data being smuggled out inside DNS queries. The data enc…	high
Outbound HTTP POST carrying synthetic PII exfil_http_post_pii	POSTs the synthetic-PII canary to a controlled endpoint over both HTTPS and plain HTTP, so content inspection can be told apart from destination filte…	high
Canary documents with synthetic sensitive data exfil_dlp_canary_documents	Writes documents whose content is what data-loss-prevention rules look for — Luhn-valid but unissued test card numbers, national-ID-shaped strings, AP…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.