Sysmon Event ID 22: DNS Query — QueryName, QueryResults and KQL

What it records

Microsoft’s description: “This event is generated when a process executes a DNS query, whether the result is successful or fails, cached or not. The telemetry for this event was added for Windows 8.1 so it is not available on Windows 7 and earlier.”

The fields are QueryName (the name looked up), QueryStatus (the result status, 0 for success), QueryResults (what came back), and the asking process — Image, ProcessGuid, ProcessId and User — with UtcTime and RuleName. The process is what makes the event valuable. A DNS server sees that a workstation resolved a domain; event 22 shows that rundll32.exe running as the user did, and its ProcessGuid leads to the command line that started it and to the connection it made next.

Because every process resolves names constantly, configurations usually exclude well-known domains in the <DnsQuery> section and log the rest:

<DnsQuery onmatch="exclude">
  <QueryName condition="end with">.microsoft.com</QueryName>
  <QueryName condition="end with">.windowsupdate.com</QueryName>
</DnsQuery>

An exclude list is also an attacker’s hiding place: a domain on a service you excluded is invisible here.

When it matters

Pattern	Reading
Office, script hosts, rundll32.exe or regsvr32.exe resolving external names	Code fetching a payload or contacting its server
A name seen on one or two hosts only, queried at regular intervals	Command and control from a small number of infected machines (T1071.004)
Long, random-looking labels under one domain (a9f3k2…​.example.net)	Data carried in DNS names, or domain generation (T1568)
Many failed lookups (non-zero QueryStatus) for different names from one process	A domain generation algorithm trying candidate domains
Dynamic-DNS, paste and file-sharing domains resolved by servers	Staging or exfiltration from a machine that should not browse

How to investigate

DNS lookups by processes that usually do not need the network:

Event
| where TimeGenerated > ago(7d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 22
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend QueryName = tostring(f.QueryName), Image = tostring(f.Image), QueryResults = tostring(f.QueryResults), Account = tostring(f.User)
| where Image has_any ("rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "cscript.exe", "WINWORD.EXE", "EXCEL.EXE")
| project TimeGenerated, Computer, Account, Image, QueryName, QueryResults

Rare names — resolved on few hosts in the last 30 days:

Event
| where TimeGenerated > ago(30d)
| where Source == "Microsoft-Windows-Sysmon" and EventID == 22
| extend D = parse_xml(EventData).DataItem.EventData.Data
| mv-apply d = D on (summarize f = make_bag(bag_pack(tostring(d["@Name"]), tostring(d["#text"]))))
| extend QueryName = tolower(tostring(f.QueryName)), Image = tostring(f.Image)
| summarize Hosts = dcount(Computer), Queries = count(), Processes = make_set(Image, 5), LastSeen = max(TimeGenerated) by QueryName
| where Hosts <= 2
| order by LastSeen desc

For a suspicious name, take the addresses in QueryResults to the process’s network connections with the same ProcessGuid, and the ProcessGuid to its process creation event for the command line and parent. Check the addresses with the IP blocklist checker.