{
  "id": "22",
  "source": "sysmon",
  "category": "Network",
  "name": "DNSEvent (DNS query)",
  "priority": "P1",
  "applicable_version": "Sysmon 10.0 and later; DNS query logging must be enabled",
  "last_reviewed": "2026-07-10",
  "definition": "Sysmon Event ID 22 records DNS queries made by a process and connects requested domains to the initiating executable.",
  "trigger_scenarios": "The event is generated when a configured process performs a DNS query. It can include the queried name, result, status, and process context.",
  "key_fields": [
    {
      "field": "Image / ProcessGuid",
      "explanation": "The querying process and stable process identifier. Join to Event ID 1 to understand how the process was launched."
    },
    {
      "field": "QueryName",
      "explanation": "The requested domain. Look for newly observed domains, suspicious subdomains, and names inconsistent with the process role."
    },
    {
      "field": "QueryStatus / QueryResults",
      "explanation": "The DNS response status and returned records. Repeated failures or rapidly changing responses can provide useful context."
    }
  ],
  "false_positives": [
    "Browsers, cloud applications, security agents, and update clients issue large volumes of DNS queries.",
    "CDNs and telemetry services often create domains unfamiliar to analysts."
  ],
  "related_event_ids": [
    "1",
    "3"
  ],
  "attck_mapping": [
    {
      "technique_id": "T1071.004",
      "technique_name": "Application Layer Protocol: DNS"
    },
    {
      "technique_id": "T1568",
      "technique_name": "Dynamic Resolution"
    }
  ],
  "detection_notes": "T1071.004 DNS C2 is concrete when Image is powershell.exe or wscript.exe and QueryName is followed by Event ID 3 to DestinationPort 443 or 53. High-entropy subdomains or repeated QueryStatus failures should be correlated with ProcessGuid, not treated as a standalone verdict. A repeated timeout=60 second DNS-to-network correlation window is a practical starting point.",
  "kql_snippet": "Sysmon\n| where EventID == 22\n| where Image has_any (\"\\\\powershell.exe\", \"\\\\wscript.exe\", \"\\\\mshta.exe\")\n| project TimeGenerated, Computer, Image, QueryName, QueryStatus, QueryResults, ProcessGuid",
  "spl_snippet": "index=sysmon EventCode=22\n| search Image IN (\"*\\\\powershell.exe\", \"*\\\\wscript.exe\", \"*\\\\mshta.exe\")\n| table _time, host, Image, QueryName, QueryStatus, QueryResults, ProcessGuid",
  "sample_log": "UtcTime: 2026-07-10 03:20:13.000\nImage: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\nQueryName: example.invalid\nQueryStatus: 0\nQueryResults: 203.0.113.10\nProcessGuid: {11111111-2222-3333-4444-555555555555}",
  "source_url": "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon",
  "route": "/sysmon-events/22/",
  "canonical_url": "https://soceventlookup.com/sysmon-events/22/",
  "json_url": "/api/events/sysmon/22.json"
}