Sysmon 22 — DNS query

Sysmon 22 — DNS query. Sysmon records dns query through its Windows Operational channel.

Source and collection

Microsoft-Windows-Sysmon/Operational; native XML export, not an EVTX binary file.

Install Sysmon and review the installed schema and filtering configuration. Use sysmon64 -s to inspect supported fields; preserve the deployed configuration version.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — events[0].event.original

Decoded event.original string; retained the complete Event XML element, excluding any appended rendered message; native XML values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 5cadfddcce0ab410e19e8dca387291383b7302df9daa532ddecf5ed0df30950c

<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/><EventID>22</EventID><Version>5</Version><Level>4</Level><Task>22</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2019-07-18T03:34:02.025223900Z'/><EventRecordID>66</EventRecordID><Correlation/><Execution ProcessID='2828' ThreadID='1684'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>vagrant-2016</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'></Data><Data Name='UtcTime'>2019-07-18 03:34:01.239</Data><Data Name='ProcessGuid'>{fa4a0de6-e8a8-5d2f-0000-001094619900}</Data><Data Name='ProcessId'>356</Data><Data Name='QueryName'>go.microsoft.com</Data><Data Name='QueryStatus'>0</Data><Data Name='QueryResults'>type:  5 go.microsoft.com.edgekey.net;type:  5 e11290.dspg.akamaiedge.net;::ffff:89.160.20.156;</Data><Data Name='Image'>C:\Program Files\Internet Explorer\iexplore.exe</Data></EventData></Event>

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`Microsoft-Windows-Sysmon`	XML text
`EventID`	XML text
`Version`	XML text
`Level`	XML text
`Task`	XML text
`Opcode`	XML text
`Keywords`	XML text
`TimeCreated`	XML text
`EventRecordID`	XML text
`Correlation`	XML text
`Execution`	XML text
`Channel`	XML text
`Computer`	XML text
`Security`	XML text
`RuleName`	XML text
`UtcTime`	XML text
`ProcessGuid`	XML text
`ProcessId`	XML text
`QueryName`	XML text
`QueryStatus`	XML text
`QueryResults`	XML text
`Image`	XML text

EventID: 22 in Microsoft-Windows-Sysmon.
UtcTime: Producer-supplied event time.
ProcessGuid: Process correlation identifier where present; case-sensitive field names vary by event.
Relevant fields: ProcessGuid, QueryName, QueryStatus, QueryResults

Investigation uses

Connect DNS queries to the responsible process and corroborate network activity.
Correlate ProcessGuid across Sysmon events; keep the host identity and time interval with every join.

Validation boundaries

DNS query data does not prove a later connection; cached answers and query outcomes affect interpretation.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

DC0096 — conceptual telemetry association, not coverage proof

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.