Sysmon Event ID 22: DNS query
Records DNS lookups with the process that made them.
- Log
- Microsoft-Windows-Sysmon/Operational
- Category
- Network
Why it matters
- Links domains to processes: a script engine resolving a newly registered domain is worth checking.
What to check
Check QueryName, QueryResults and Image.
How to turn it on
Sysmon configuration including DnsQuery (Windows 8.1 / Server 2012 R2 and later).
MITRE ATT&CK
- T1071.004 Application Layer Protocol: DNS