DoHFind: DNS-over-HTTPS (DoH) plugin for Volatility 3

DoHFind is a Windows Volatility 3 extension/plugin that helps investigators identify DNS over HTTPS (DoH) activity in memory and surface artifacts relevant to Command and Control (C2) analysis.

DoH-based C2 is attractive to adversaries because it can look like normal encrypted web traffic while quietly carrying DNS command channels. In real investigations, that can mean:

• Missed DNS-layer detections
• Reduced domain-level visibility
• Delayed understanding of malware staging/exfiltration behavior

Motivation

Modern malware and C2 frameworks increasingly abuse DoH because it blends DNS traffic into normal HTTPS (443/tcp) and bypasses many traditional DNS controls.

Classic DNS visibility relies on UDP/TCP 53 telemetry from enterprise resolvers. DoH changes this model:

• DNS queries are encapsulated in HTTPS requests (often to public resolvers like Google or Cloudflare).
• Domain resolution activity may not appear in normal enterprise DNS logs.
• Security teams may only see encrypted outbound HTTPS to a trusted resolver domain/IP.

From an incident response perspective, memory can still contain highly valuable traces:

• DoH request URLs (/resolve?name=..., /dns-query?dns=...)
• HTTP headers (application/dns-message)
• JSON response fragments ("Answer", "Question", "Status")
• Decoded domains and resolved IPs
• Encoded high-entropy labels used in DNS-based exfiltration

DoHFind was built to bridge this visibility gap during triage and deep investigation.

What the extension does

DoHFind performs a two-phase workflow:

1. Network triage via netscan

• Identifies processes with connections involving port 443.
• Associates candidate PIDs with remote addresses.
• Focuses memory scanning on likely HTTPS-active processes (unless --scan-all is used).

2. Process memory artifact extraction

• Walks each target process VAD region.
• Searches for DoH request/response indicators.
• Extracts investigation-ready data fields (domain, detail, context).

How to use

1. Basic usage

python vol.py -f <memory_image> windows.dohfind

This scans only processes that netscan associates with port 443 activity.

2. Scan specific process IDs

python vol.py -f <memory_image> windows.dohfind --pid 1234 5678

3. Force scan of all processes

python vol.py -f <memory_image> windows.dohfind --scan-all

Use this when:

• netscan coverage is incomplete for the memory image
• You suspect historical artifacts in memory without active 443 objects

4. Include corrupt network objects from netscan

python vol.py -f <memory_image> windows.dohfind --include-corrupt

This may increase coverage in damaged/smeared memory but can also add noise.

Investigation workflow recommendation

1. Run windows.info and windows.pslist to baseline image quality and process inventory.
2. Run windows.netscan to understand active/recoverable network artifacts.
3. Run windows.dohfind to extract DoH-focused process memory evidence.
4. Pivot by PID and Domain into complementary plugins (cmdline, dlllist, handles, malfind, etc.).
5. Correlate extracted domains/IPs with external intelligence and timeline data.

Interpreting results safely

DoHFind provides forensic leads, not final attribution. Treat hits as evidence candidates:

• Validate suspicious domains/IPs against expected enterprise traffic.
• Compare repeated findings across multiple memory regions and processes.
• Correlate with endpoint logs, proxy logs, EDR telemetry, and timeline context.

Potential false positives can occur when generic strings (for example https, dns, or JSON fragments) appear in unrelated buffers. The plugin currently reports the following artifact types:

• DoH JSON API Request
  • Examples: GET /resolve?name=<domain>&type=A
• DoH RFC8484 GET Request
  • Example: /dns-query?dns=<base64url>
  • Attempts to decode DNS wire payload into a queried domain name
• DoH Resolver Hostname
  • Known resolver domains (Google, Cloudflare, Quad9, OpenDNS, etc.)
• DoH Content-Type
  • application/dns-message, application/dns-json
• DoH JSON Response
  • Extracts name, data, and type where available
• DoH JSON Question
  • Standalone question block with corroborating JSON context
• DoH Resolver IP
  • Known resolver IP near DoH/HTTPS context in memory
• DNS Exfiltration
  • High-entropy long labels near DoH markers (potential tunneling/exfil pattern)

Dependencies and notes

• This plugin depends on standard Volatility 3 Windows plugin ecosystem components (notably pslist and netscan).
• In many environments, netscan availability requires pefile.
• If netscan cannot load, install missing dependencies and re-run.

Example dependency install:

pip install pefile