win:sysmon 22
DNSEvent (DNS query)
This event is generated when a process executes a DNS query, whether the result is successful or fails, cached or not.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 130
- Rules depending on it
- Splunk 23, Sigma 28
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
- T1001.001 Junk Data
- T1001.002 Steganography
- T1001.003 Protocol or Service Impersonation
- T1008 Fallback Channels
- T1011 Exfiltration Over Other Network Medium
- T1018 Remote System Discovery
- T1020 Automated Exfiltration
- T1021 Remote Services
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.003 Distributed Component Object Model
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.012 LNK Icon Smuggling
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode
- T1029 Scheduled Transfer
- T1030 Data Transfer Size Limits
- T1036.012 Browser Fingerprint
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1048 Exfiltration Over Alternative Protocol
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.002 File Transfer Protocols
- T1071.003 Mail Protocols
- T1071.004 DNS
- T1071.005 Publish/Subscribe Protocols
- T1078.002 Domain Accounts
- T1090 Proxy
- T1090.001 Internal Proxy
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1090.004 Domain Fronting
- T1095 Non-Application Layer Protocol
- T1102 Web Service
- T1102.001 Dead Drop Resolver
- T1102.002 Bidirectional Communication
- T1102.003 One-Way Communication
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer
- T1114 Email Collection
- T1114.001 Local Email Collection
- T1114.002 Remote Email Collection
- T1125 Video Capture
- T1127 Trusted Developer Utilities Proxy Execution
- T1127.001 MSBuild
- T1127.003 JamPlus
- T1129 Shared Modules
- T1132 Data Encoding
- T1132.001 Standard Encoding
- T1132.002 Non-Standard Encoding
- T1133 External Remote Services
- T1135 Network Share Discovery
- T1176 Software Extensions
- T1176.001 Browser Extensions
- T1176.002 IDE Extensions
- T1185 Browser Session Hijacking
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1195.002 Compromise Software Supply Chain
- T1197 BITS Jobs
- T1199 Trusted Relationship
- T1200 Hardware Additions
- T1202 Indirect Command Execution
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1204.001 Malicious Link
- T1204.004 Malicious Copy and Paste
- T1205 Traffic Signaling
- T1205.001 Port Knocking
- T1205.002 Socket Filters
- T1210 Exploitation of Remote Services
- T1213.006 Databases
- T1216.001 PubPrn
- T1218 System Binary Proxy Execution
- T1218.001 Compiled HTML File
- T1218.003 CMSTP
- T1218.005 Mshta
- T1218.007 Msiexec
- T1218.008 Odbcconf
- T1218.009 Regsvcs/Regasm
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1218.012 Verclsid
- T1218.013 Mavinject
- T1218.014 MMC
- T1218.015 Electron Applications
- T1219 Remote Access Tools
- T1219.002 Remote Desktop Software
- T1221 Template Injection
- T1480 Execution Guardrails
- T1480.001 Environmental Keying
- T1496 Resource Hijacking
- T1496.001 Compute Hijacking
- T1496.002 Bandwidth Hijacking
- T1498 Network Denial of Service
- T1498.001 Direct Network Flood
- T1498.002 Reflection Amplification
- T1499.002 Service Exhaustion Flood
- T1550.002 Pass the Hash
- T1557 Adversary-in-the-Middle
- T1557.002 ARP Cache Poisoning
- T1563 Remote Service Session Hijacking
- T1563.002 RDP Hijacking
- T1565.002 Transmitted Data Manipulation
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1567 Exfiltration Over Web Service
- T1567.001 Exfiltration to Code Repository
- T1567.002 Exfiltration to Cloud Storage
- T1567.003 Exfiltration to Text Storage Sites
- T1567.004 Exfiltration Over Webhook
- T1568 Dynamic Resolution
- T1568.001 Fast Flux DNS
- T1568.002 Domain Generation Algorithms
- T1568.003 DNS Calculation
- T1569.002 Service Execution
- T1572 Protocol Tunneling
- T1573 Encrypted Channel
- T1573.001 Symmetric Cryptography
- T1573.002 Asymmetric Cryptography
- T1606.001 Web Cookies
- T1684 Social Engineering
- T1686.003 Windows Host Firewall
Rules that depend on it
Splunk 23
- 3CX Supply Chain Attack Network Indicators
- DNS Kerberos Coercion
- DNS Query Length With High Standard Deviation
- Detect DNS Query to Decommissioned S3 Bucket
- Detect Remote Access Software Usage DNS
- Detect hosts connecting to dynamic domain providers
- Local LLM Framework DNS Query
- Ngrok Reverse Proxy on Network
- Rundll32 DNSQuery
- Sunburst Correlation DLL and Network Event
- Suspicious Process DNS Query Known Abuse Web Services
- Suspicious Process With Discord DNS Query
- Wermgr Process Connecting To IP Check Web Services
- Windows AI Platform DNS Query
- Windows Abused Web Services
- Windows BitLockerToGo with Network Activity
- Windows DNS Query Request To TinyUrl
- Windows DNS Query Request by Telegram Bot API
- Windows Gather Victim Network Info Through Ip Check Web Services
- Windows Multi hop Proxy TOR Website Query
- Windows Non-System Process Querying Definition Update
- Windows Spearphishing Attachment Connect To None MS Office Domain
- Windows Visual Basic Commandline Compiler DNSQuery
Sigma 28
- AppX Package Installation Attempts Via AppInstaller.EXE by frack113
- Cloudflared Tunnels Related DNS Requests by Nasreddine Bencherchali (Nextron Systems)
- DNS HybridConnectionManager Service Bus by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- DNS Query Request By QuickAssist.EXE by Muhammad Faisal (@faisalusuf)
- DNS Query Request By Regsvr32.EXE by Dmitriy Lifanov, oscd.community
- DNS Query Request To OneLaunch Update Service by Josh Nickels
- DNS Query To AzureWebsites.NET By Non-Browser Process by Nasreddine Bencherchali (Nextron Systems)
- DNS Query To Common Malware Hosting and Shortener Services by Ahmed Nosir (@egycondor)
- DNS Query To Devtunnels Domain by citron_ninja
- DNS Query To Katz Stealer Domains by Swachchhanda Shrawan Poudel (Nextron Systems)
- DNS Query To MEGA Hosting Website by Aaron Greetham (@beardofbinary) - NCC Group
- DNS Query To Remote Access Software Domain From Non-Browser App by frack113, Connor Martin
- DNS Query To Ufile.io by yatinwad, TheDFIRReport
- DNS Query To Visual Studio Code Tunnels Domain by citron_ninja
- DNS Query Tor .Onion Address - Sysmon by frack113
- DNS Query by Finger Utility by Swachchhanda Shrawan Poudel (Nextron Systems)
- DNS Query for Anonfiles.com Domain - Sysmon by pH-T (Nextron Systems)
- DNS Server Discovery Via LDAP Query by frack113
- DPRK Threat Actor - C2 Communication DNS Indicators by Nasreddine Bencherchali (Nextron Systems)
- Diamond Sleet APT DNS Communication Indicators by Nasreddine Bencherchali (Nextron Systems)
- Notepad++ Updater DNS Query to Uncommon Domains by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential Compromised 3CXDesktopApp Beaconing Activity - DNS by Nasreddine Bencherchali (Nextron Systems)
- Potential SocGholish Second Stage C2 DNS Query by Dusty Miller
- Suspicious Cobalt Strike DNS Beaconing - Sysmon by Florian Roth (Nextron Systems)
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious DNS Query for IP Lookup Service APIs by Brandon George (blog post), Thomas Patzke
- TanStack Supply-Chain Attack DNS Indicators by Leonardo Gasparini
- TeamViewer Domain Query By Non-TeamViewer Application by Florian Roth (Nextron Systems)
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Network source and destinationAppendix B item 5(2) | Supports an activity | our analysis: DNS queries by process |
| OMB M-26-14: Indicators of compromiseAppendix B item 5(7) | Supports an activity | our analysis: domains queried by process |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | DnsRequest | Full | pySigma-backend-crowdstrike: dns_query -> DnsRequest |
| Microsoft Defender for Endpoint device tables | DeviceEvents | Partial | our analysis: DNS query inspection is an ActionType family in DeviceEvents on supported OS versions, not a dedicated table |