22 Sysmon log · DNS Query low severity very-high volume

Sysmon Event ID 22 — DNS query

A process made a DNS query. QueryName, QueryResults, Image are key.

Why event 22 matters

DNS-based C2 (T1071.004) — regular DNS queries for domains with high entropy names (DGA domains) or known C2 infrastructure. Data exfiltration via DNS (data encoded in query names). Process-specific DNS anomalies (cmd.exe resolving external domains, PowerShell querying unusual TLDs). Domain Generation Algorithm (DGA) detection — high-entropy subdomain patterns.

How to detect it

Alert: Image is cmd.exe, PowerShell, or unusual process resolving external domains. Alert: QueryName with high entropy (>4.0 Shannon entropy). Alert: queries to recently registered domains. Correlate QueryName with threat intel domain blocklists.

Log source
Microsoft-Windows-Sysmon/Operational
Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).
Fields to pivot on
ImageQueryNameQueryResults

MITRE ATT&CK mapping

Tactic Technique
Command and Control DNS (T1071.004)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sigma rule
title: Suspicious DNS Query by Scripting Engine
status: experimental
description: Command interpreter or scripting engine making DNS query
author: theadminstack.com
date: 2026/05/16
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\cmd.exe'
            - '\\powershell.exe'
            - '\\wscript.exe'
            - '\\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate admin scripts making DNS lookups
level: medium
tags:
    - attack.command_and_control
    - attack.t1071.004
Sentinel / Defender KQL
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 22   // DNS query
// EventData holds: Image, QueryName, QueryResults
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc
Splunk SPL
index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# DNS query — add EventData fields: Image, QueryName, QueryResults`
Hunt event 22 in Sentinel/Defender →
Build a KQL query for this event in the KQL Query Builder.
Search all event IDs →
Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 22?

DNS query. A process made a DNS query. QueryName, QueryResults, Image are key.

Which log records event 22?

Event 22 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 22?

Event 22 is associated with: DNS (T1071.004).

How do you detect activity around event 22?

Alert: Image is cmd.exe, PowerShell, or unusual process resolving external domains. Alert: QueryName with high entropy (>4.0 Shannon entropy). Alert: queries to recently registered domains. Correlate QueryName with threat intel domain blocklists.