How to Get a Log of DNS Queries with Sysmon
- Sysmon — Windows Sysinternals | Microsoft Docs
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
Sysmon now supports logging DNS queries, so I tried to get the logs. I checked this procedure with Windows 10 on VMware.
Sysmon Installation Instructions
- Download Sysmon from the official site.
- Extract the files to a folder of your choice.
- Launch a command prompt with administrator privileges.
- Change to the directory where you extracted Sysmon and type Sysmon -i.
(When you start it for the first time, you will be asked to check the terms of use.)
Installation is complete.
Event Log Location
Sysmon logs are all located in the Applications and Services Log > Microsoft > Windows > Sysmon Operational.
Enable DNS query logging
By default, DNS queries are not logged. I will change the setting to enable logging of DNS queries.
Using Notepad, create a file with the following contents and save it with the filename config-dnsquery.xml.
<Sysmon schemaversion="4.21">
<EventFiltering>
<DnsQuery onmatch="exclude" />
</EventFiltering>
</Sysmon>Take this file to the same folder where you extracted Sysmon and type Sysmon.exe -c config-dnsquery.xml to apply the settings.
This starts logging DNS queries.
DNS query log Location
Sysmon logs are all located in the Applications and Services Log > Microsoft > Windows > Sysmon Operational. A log of DNS queries has an event ID of 22.
DNS query log is noisy
You can find the Sysmon configuration files at the following site:
- SwiftOnSecurity/sysmon-config: Sysmon configuration file template with default high-quality event tracing
https://github.com/SwiftOnSecurity/sysmon-config
There is a test version that contains settings for the DNS query log.
- z-AlphaVersion.xml
https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/z-AlphaVersion.xml
This test version has been configured to exclude some common domains from the DNS log. In general, the DNS query log is expected to be large. If you want to stand on the shoulders of giants, you might want to apply this configuration file.
Can I get a log for DNS over HTTPS (DoH)?
I haven’t tried it yet, but there was a blog saying that Sysmon can’t get it.
Sysmon 10.0 — New features and changes — Olaf Hartong — Medium
Depending on your configuration you might be able to see the activity in EventID 3 (NetworkConnection), but you will not see the request itself. The only thing you might be able to see is unexpected processes calling out to one of the DoH providers.
Thanks.
References
- Microsoft Releases Sysmon 10 With DNS Query Logging Feature
https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-sysmon-10-with-dns-query-logging-feature/ - SYSMON Uninstall Issue
https://social.technet.microsoft.com/Forums/en-US/142239d8-9e08-4719-908d-1be9b1d91ae6/sysmon-uninstall-issue?forum=miscutils - Sysmon 10.0 — New features and changes — Olaf Hartong — Medium
https://medium.com/@olafhartong/sysmon-10-0-new-features-and-changes-e82106f2e00
Appendix
Uninstall Sysmon
You can uninstall by entering Sysmon.exe -u at a command prompt executed with administrator privileges.
If you have trouble installing the software after uninstalling it, follow the steps below to delete the related files.
- Run regedit.exe and delete the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Sysmondrv registry key
- Delete the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Sysmon registry key
- Restart the machine then delete the c:\windows\sysmondrv.sys and c:\windows\sysmon.exe files.
Sysmon Might Not Work in a Virtual Environment
When we tried Sysmon on VMware, it sometimes didn’t work in a Windows 7 environment.
- Windows 7: Sysmon won’t boot and says it’s an unsupported processor
- Windows 7: Sysmon Launches, But Unable To Log DNS Queries & Attempts To Uninstall, BSoD Occurs
- Windows 10: As if by magic; Sysmon just logged DNS queries without any trouble
The first and second bullet points of Windows 7 are different environments. I haven’t been able to identify the reason for this yet.
Update History
- 2019/06/17 New.
- 2019/06/17 Fixed some mistakes.
- 2020/03/03 Revised.
