DNS query process

๐Ÿ”’ Secure Bits ๐Ÿ’ก
Ever needed to find outย ๐˜„๐—ต๐—ถ๐—ฐ๐—ต ๐—ฝ๐—ฟ๐—ผ๐—ฐ๐—ฒ๐˜€๐˜€ is behind a ๐˜€๐˜‚๐˜€๐—ฝ๐—ถ๐—ฐ๐—ถ๐—ผ๐˜‚๐˜€ ๐——๐—ก๐—ฆ ๐—พ๐˜‚๐—ฒ๐—ฟ๐˜†?

I recently worked with a customer who noticed ๐˜„๐—ฒ๐—ถ๐—ฟ๐—ฑ ๐——๐—ก๐—ฆ ๐—ฟ๐—ฒ๐—พ๐˜‚๐—ฒ๐˜€๐˜๐˜€ to Uzbekistan addresses.

๐Ÿ›‘ I enabled all possible DNS logs, but none provided the process name behind the queries.

๐Ÿ’ก Thatโ€™s where Sysmon saved the day.

Sysmon is a powerful auditing tool that lets you apply filters to reduce unnecessary logs โ†’ saving storage space and licensing costs.

โœ… ๐—ง๐—ต๐—ฒ ๐—ธ๐—ฒ๐˜†? ๐—˜๐˜ƒ๐—ฒ๐—ป๐˜ ๐—œ๐—— ๐Ÿฎ๐Ÿฎ
With Sysmon Event ID 22, you can log DNS queries while capturing the exact process responsibleโ€”and thatโ€™s how I found the source of the suspicious traffic. There are of course other ways to solve this, but in my case this was the quick one !

๐——๐—ผ ๐˜†๐—ผ๐˜‚ ๐˜‚๐˜€๐—ฒ ๐—ฆ๐˜†๐˜€๐—บ๐—ผ๐—ป ๐—ถ๐—ป ๐˜†๐—ผ๐˜‚๐—ฟ ๐—ฒ๐—ป๐˜ƒ๐—ถ๐—ฟ๐—ผ๐—ป๐—บ๐—ฒ๐—ป๐˜?