CASB tools blind to QUIC traffic over UDP
Cloud Access Security Brokers fail to inspect HTTP/3 traffic using QUIC protocol over UDP, allowing Chrome and other browsers to bypass block policies undetected.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Security teams relying on Cloud Access Security Brokers (CASBs) to enforce web access policies face a significant enforcement gap documented by major vendors including Palo Alto Networks, Forcepoint, and Cloudflare. CASBs perform SSL/TLS inspection on TCP traffic to block unauthorized destinations, but cannot inspect QUIC protocol connections that run over UDP. When browsers like Chrome automatically negotiate QUIC connections to reach HTTP/3-enabled servers, the traffic bypasses CASB inspection entirely, leaving no log entries to indicate the block policy failed.
Testing across five browsers on managed endpoints revealed inconsistent enforcement: Safari connections were blocked as expected while Chrome reached the same blocked destinations freely. This occurs because QUIC runs over UDP port 443 rather than TCP, and proxy-based inspection tools were designed before QUIC became widespread. The gap is particularly concerning for organizations blocking generative AI services, where Netskope research shows 223 average monthly policy violations per organization and a doubling of sensitive data incidents sent to AI platforms year-over-year.
The article provides a 20-minute testing methodology for security teams to validate enforcement across all browsers in their environment. Recommended mitigations include blocking UDP port 443 at the network perimeter to force browsers back to TCP, testing every browser independently rather than assuming uniform behavior, and considering browser-native DLP solutions that apply policy from within the browser itself. For compliance-regulated organizations under GDPR, HIPAA, PCI DSS, or SOC 2, this undetected enforcement gap represents both a security and regulatory risk.
Detection guidance
Browser Traffic Over QUIC (UDP/443) Bypassing TCP-Based Inspection
A behavioural hunt for the technique in general.
Detects browsers establishing outbound UDP/443 (QUIC) connections, which bypass CASB/TLS-inspecting proxies that only analyze TCP traffic, enabling silent policy bypass to blocked or unsanctioned web/AI services. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Browser Traffic Over QUIC (UDP/443) Bypassing TCP-Based Inspection
id: 84a325b0-b7d1-5345-bdf5-f4abf3cb8eef
status: experimental
description: 'Detects browser processes initiating outbound connections over UDP destination
port 443 (QUIC/HTTP3).
Because CASB and TLS-inspecting proxies typically only decrypt and enforce policy
on TCP traffic,
QUIC connections over UDP can silently bypass web access controls, allowing users
to reach blocked
destinations (including generative AI services) with no corresponding block log
entry.
'
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 443
Protocol: udp
Image|endswith:
- \chrome.exe
- \msedge.exe
- \brave.exe
- \opera.exe
- \vivaldi.exe
condition: selection
fields:
- Image
- User
- DestinationIp
- DestinationHostname
- DestinationPort
falsepositives:
- Legitimate QUIC/HTTP3 usage to Google, YouTube, Facebook, or other HTTP/3-enabled
services with no policy concern
- Normal browsing to any HTTP/3-enabled site where UDP/443 is the expected transport
level: low
tags:
- attack.t1071.001
author: Vorant
Non-Browser Process Establishing Sustained UDP/443 QUIC-like Sessions
A behavioural hunt for the technique in general.
Flags non-browser processes (e.g., custom tools, scripts, or agents) initiating outbound UDP/443 connections, a pattern consistent with abusing the QUIC-inspection blind spot to exfiltrate data or communicate over an inspected-looking but uninspected channel. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Browser Process Establishing Sustained UDP/443 QUIC-like Sessions
id: 90ed492f-0cc5-5495-9cd7-e9ff47073b07
status: experimental
description: 'Detects processes other than known browsers establishing outbound connections
on UDP destination
port 443, mimicking QUIC traffic. Since perimeter CASB/proxy tools generally do
not inspect UDP/443,
non-browser software using this port/protocol combination may represent an attempt
to move data or
beacon out via an unencrypted or lightly-inspected channel that evades web policy
enforcement,
consistent with exfiltration over a non-standard protocol that reuses the browser-associated
port.
'
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 443
Protocol: udp
filter_browsers:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \brave.exe
- \opera.exe
- \vivaldi.exe
- \firefox.exe
- \safari.exe
filter_system:
Image|endswith:
- \svchost.exe
- \SearchApp.exe
condition: selection and not filter_browsers and not filter_system
fields:
- Image
- CommandLine
- User
- DestinationIp
- DestinationHostname
falsepositives:
- Native OS or update services that legitimately use QUIC/HTTP3 (e.g., some Microsoft
or Google update agents)
- Custom internal applications adopting QUIC for performance reasons
level: medium
tags:
- attack.t1048.003
- attack.exfiltration
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33084
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs