Sysmon Event ID 22: DNSEvent (DNS query)
Sysmon Event ID 22 records DNS queries made by a process and connects requested domains to the initiating executable.
- Applicable version
- Sysmon 10.0 and later; DNS query logging must be enabled
- Last reviewed
- 2026-07-10
Trigger Scenarios
The event is generated when a configured process performs a DNS query. It can include the queried name, result, status, and process context.
Key Fields
Image / ProcessGuid
The querying process and stable process identifier. Join to Event ID 1 to understand how the process was launched.
QueryName
The requested domain. Look for newly observed domains, suspicious subdomains, and names inconsistent with the process role.
QueryStatus / QueryResults
The DNS response status and returned records. Repeated failures or rapidly changing responses can provide useful context.
Common False Positives
- Browsers, cloud applications, security agents, and update clients issue large volumes of DNS queries.
- CDNs and telemetry services often create domains unfamiliar to analysts.
Related Events
MITRE ATT&CK Mapping
- T1071.004Application Layer Protocol: DNS
- T1568Dynamic Resolution
Detection Notes
T1071.004 DNS C2 is concrete when Image is powershell.exe or wscript.exe and QueryName is followed by Event ID 3 to DestinationPort 443 or 53. High-entropy subdomains or repeated QueryStatus failures should be correlated with ProcessGuid, not treated as a standalone verdict. A repeated timeout=60 second DNS-to-network correlation window is a practical starting point.
Sysmon
| where EventID == 22
| where Image has_any ("\\powershell.exe", "\\wscript.exe", "\\mshta.exe")
| project TimeGenerated, Computer, Image, QueryName, QueryStatus, QueryResults, ProcessGuidindex=sysmon EventCode=22
| search Image IN ("*\\powershell.exe", "*\\wscript.exe", "*\\mshta.exe")
| table _time, host, Image, QueryName, QueryStatus, QueryResults, ProcessGuidUtcTime: 2026-07-10 03:20:13.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
QueryName: example.invalid
QueryStatus: 0
QueryResults: 203.0.113.10
ProcessGuid: {11111111-2222-3333-4444-555555555555}