DnsRequest: CrowdStrike Falcon DNS Event, Fields and Hunting Queries

What it records

DnsRequest is the sensor’s record of a DNS lookup attempted on a host. DomainName is the name asked for and RequestType the record type, as the standard DNS number (1 is A, 28 AAAA, 5 CNAME, 16 TXT). IP4Records holds the IPv4 answers as one semicolon-separated string, which CrowdStrike’s queries split before counting. Windows records add DnsRequestCount, DualRequest and InterfaceIndex; on mobile devices the schema lists AppIdentifier and IpAddress instead.

The field that makes it powerful is ContextProcessId: Falcon’s ID of the process that made the lookup. The same value is that process’s TargetProcessId in its ProcessRollup2 record on the same host, so every domain can be tied to the program, command line and user behind it. CrowdStrike’s published hunts do exactly this, for example to list the domains web browsers resolved, or to find lookups of remote-management-tool domains.

When it matters

• Command and control. A process resolving the same rare domain at regular intervals, especially one that is not a browser or an update service, is the DNS side of beaconing (MITRE ATT&CK T1071.004). The use case for Falcon beaconing walks through it.
• Generated domains. Many lookups of random-looking names from one process, each seen nowhere else in the estate, is a domain generation algorithm at work (T1568.002).
• Tunnelling. Very long DomainName values or bursts of TXT lookups under one parent domain are how tools move data inside DNS.
• The wrong process asking. rundll32.exe, regsvr32.exe, mshta.exe or an Office application resolving a domain nobody else in the estate resolves is worth following.

How to investigate

1. Start from the domain or from the host: list lookups with DomainName, RequestType, IP4Records and ContextProcessId.
2. Join to ProcessRollup2 on aid and process ID to see which program, command line and user asked.
3. Count how many hosts resolved the domain; a name seen on one or two hosts is far more interesting than one seen everywhere.
4. Check the answers in IP4Records and any NetworkConnectIP4 from the same process to those addresses.

Domains resolved by script hosts and other often-abused programs, joined to their process the way CrowdStrike’s queries do:

(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\(powershell|rundll32|regsvr32|mshta|wscript)\.exe$/i) OR (#event_simpleName=DnsRequest event_platform=Win)
| falconPID := TargetProcessId | falconPID := ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=DnsRequest}], prefilter=true)
| groupBy([aid, falconPID], function=collect([ImageFileName, CommandLine, DomainName]))

Rare domains — resolved on fewer than three hosts:

#event_simpleName=DnsRequest
| groupBy([DomainName], function=[count(aid, distinct=true, as=Hosts), count(as=Lookups)], limit=max)
| Hosts < 3
| sort(Lookups, order=desc, limit=200)

Unusually long names, a common sign of DNS tunnelling:

#event_simpleName=DnsRequest
| length(DomainName, as=NameLength)
| NameLength > 60
| groupBy([aid, ComputerName, DomainName, RequestType], function=count(as=Lookups), limit=max)
| sort(Lookups, order=desc)

Rare domains over Falcon Data Replicator data in Splunk (add your index):

sourcetype="crowdstrike:events:sensor" event_simpleName=DnsRequest
| stats dc(aid) AS Hosts, count AS Lookups by DomainName
| where Hosts < 3
| sort - Lookups
| head 200

The free log analyzer reads Falcon exports in the browser, and the CrowdStrike field reference covers the export format.