Sysmon Event ID 22: DNSEvent (DNS query)
- Applicable version
- Sysmon 10.0 and later; DNS query logging must be enabled
- Last reviewed
- 2026-07-21
Quick summary
Sysmon Event ID 22 records DNS queries made by a process and connects requested domains to the initiating executable.
Technical Metadata
| Event ID | 22 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0011 Command and Control / T1071.004 Application Layer Protocol: DNS |
| Key fields to watch | Image / ProcessGuid, QueryName, QueryStatus / QueryResults |
Trigger Scenarios
The event is generated when a configured process performs a DNS query. It can include the queried name, result, status, and process context.
Key Fields
Image / ProcessGuid
The querying process and stable process identifier. Join to Event ID 1 to understand how the process was launched.
QueryName
The requested domain. Look for newly observed domains, suspicious subdomains, and names inconsistent with the process role.
QueryStatus / QueryResults
The DNS response status and returned records. Repeated failures or rapidly changing responses can provide useful context.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 22
| project TimeGenerated, Computer, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event and retains RenderedDescription. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| table _time, host, user, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 22- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Sysmon Operational channel is ingested into Cortex XDR. Event ID 22 is not globally unique; confirm Provider is Microsoft-Windows-Sysmon before applying Sysmon field semantics.
title: Sysmon Event ID 22
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 22
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| QueryStatus | 0 | The DNS query completed successfully. | A successful result provides addresses for correlation with Event ID 3, but the status alone does not identify malicious DNS activity. Source |
MITRE ATT&CK Mapping
- T1071.004Application Layer Protocol: DNS
Detection Notes
T1071.004 DNS C2 is concrete when Image is powershell.exe or wscript.exe and QueryName is followed by Event ID 3 to DestinationPort 443 or 53. High-entropy subdomains or repeated QueryStatus failures should be correlated with ProcessGuid, not treated as a standalone verdict. A repeated timeout=60 second DNS-to-network correlation window is a practical starting point.
Common False Positives
- Browsers, cloud applications, security agents, and update clients issue large volumes of DNS queries.
- CDNs and telemetry services often create domains unfamiliar to analysts.
Related Events
Sample Log
UtcTime: 2026-07-10 03:20:13.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
QueryName: example.invalid
QueryStatus: 0
QueryResults: 203.0.113.10
ProcessGuid: {11111111-2222-3333-4444-555555555555}Frequently Asked Questions
What does Sysmon Event ID 22 record?
Sysmon Event ID 22 records DNS queries made by a process and includes the process identity, query name, status, and returned results when available.
Does one unusual DNS query prove DNS command and control?
No. Domain generation, telemetry, advertising, software updates, and security products can create unusual names; analyze process context, frequency, entropy, results, and related connections.
How should Event ID 22 be correlated with network activity?
Join by ProcessGuid and time to Sysmon Event ID 3, then compare QueryResults with destination addresses while allowing for caching, proxies, and multiple DNS answers.
Sources
- Sysmon
Microsoft · vendor
- Application Layer Protocol: DNS (T1071.004)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule