Log Dejargonizer

Sysmon · Event 22

Sysmon Event 22: A DNS query was made

A process looked up a hostname, and Sysmon recorded which process asked. That attribution is what DNS server logs cannot give you, and it turns a list of queried domains into a list of programs querying them.

Also written as Sysmon 22Sysmon Event ID 22DNSEventSysmon DNS query

What it means for you

On a personal computer

Only present if you installed Sysmon. It records which programs look up website addresses.

For an analyst

Available from Sysmon 10 onward. Its advantage over DNS server logs is process attribution; its cost is volume. Exclude your own domains, telemetry endpoints, and content delivery networks in the configuration. Note that applications using DNS-over-HTTPS bypass this entirely, which is a growing blind spot worth knowing about.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Dns query:
  RuleName: -
  UtcTime: 2026-08-28 09:14:06.118
  ProcessGuid: {a1b2c3d4-0000-0000-0000-00000000abcd}
  ProcessId: 7412
  QueryName: cdn-update.example.invalid
  QueryStatus: 0
  QueryResults: type:  5 cdn-update-edge.example.invalid;::ffff:198.51.100.203;
  Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  User: CORP\jbrooks

The fields that decide it

Everything else in the log line is context.

Image
The process that made the query. This is the entire reason to collect the event.
  • powershell.exe or cmd.exeA shell resolving a hostname, usually just before downloading something.
  • rundll32.exe, regsvr32.exe, or mshta.exeSystem binaries with no ordinary reason to resolve external names.
  • A browserOrdinary traffic and the bulk of the volume.
QueryName
The hostname that was looked up.
  • A very long random-looking subdomainCharacteristic of DNS tunnelling and of algorithmically generated domains.
  • A dynamic DNS provider domainCommon in low-effort command and control infrastructure.
  • A recently registered domainNot visible in the event itself, but worth enriching against — newly registered domains are disproportionately malicious.
QueryStatus
The result code. 0 is success; 9003 means the name does not exist, and a burst of those is itself a signal.
QueryResults
The addresses returned, when the lookup succeeded.
ProcessGuid
Join on this to pull the command line of the querying process.

Ordinary reasons this happens

Most of the time it is one of these.

  • Ordinary browsing and application traffic, which is nearly all of it.
  • Software updaters and telemetry resolving vendor endpoints.
  • Content delivery networks, which produce large numbers of distinct hostnames legitimately.
  • Domain-joined machines resolving internal infrastructure constantly.
  • Failed lookups for internal names on machines temporarily off the corporate network.

When it is not ordinary

A download cradle resolving a payload host.

What gives it awayA shell or scripting engine querying an external name, usually immediately before a network connection.

ATT&CK T1105

Command and control using a generated domain.

What gives it awayMany failed lookups for random-looking names from one process, as the malware works through a list looking for the live one.

ATT&CK T1568.002

Data smuggled out through DNS.

What gives it awayLong, high-entropy subdomains under a single parent domain, queried repeatedly by one process.

ATT&CK T1071.004

Infrastructure hosted on dynamic DNS.

What gives it awayQueries to dynamic DNS providers from processes that are not browsers.

ATT&CK T1071.001

What to do next

  1. Read the Image. A shell or system binary resolving an external name is the pattern to chase.
  2. Join on ProcessGuid to Sysmon Event 1 for the command line.
  3. Check Sysmon Event 3 for the connection that followed the lookup.
  4. Look at the shape of the query name — length, randomness, and depth of subdomain all matter.
  5. Count failed lookups per process. A burst of non-existent names is a strong signal.
  6. Enrich the domain against registration age and reputation before deciding.

Queries to run

kql Shells and system binaries resolving hostnames. Short list and consistently worth reading. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 22 | extend Proc = tostring(split(Image, '\\')[-1]) | where Proc in~ ('powershell.exe','cmd.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe') | project TimeGenerated, Computer, Proc, QueryName
kql Long subdomain labels repeated under one parent domain — the shape of DNS tunnelling. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 22 | extend Label = tostring(split(QueryName, '.')[0]) | where strlen(Label) > 30 | summarize count() by Image, tostring(split(QueryName, '.')[-2]), Computer | where count_ > 20
kql Bursts of lookups for names that do not exist, characteristic of generated-domain malware searching for a live server. 
Event | where Source == 'Microsoft-Windows-Sysmon' and EventID == 22 and QueryStatus == '9003' | summarize failures = dcount(QueryName) by Image, Computer, bin(TimeGenerated, 10m) | where failures > 30
splunk 
index=sysmon EventCode=22 | stats dc(QueryName) as domains by Image host | sort -domains

Common questions

What version of Sysmon added DNS logging?

Event 22 arrived in Sysmon 10. Earlier versions cannot record DNS queries at all, so if you are not seeing them, check your version before troubleshooting the configuration.

Why use Sysmon Event 22 instead of DNS server logs?

Because it names the process that made the query. A DNS server log tells you a machine looked up a domain; Sysmon tells you which program did, which is usually the difference between an unactionable alert and a clear one. The trade-off is volume and the need to deploy Sysmon everywhere.

Does Sysmon Event 22 capture DNS-over-HTTPS?

No. Applications that resolve names through encrypted DNS bypass the Windows resolver entirely, so no event is generated. Browsers increasingly do this by default, which is a real and growing blind spot — the usual mitigation is policy that forces browsers to use the system resolver.

How do I detect DNS tunnelling with Sysmon Event 22?

Look at the shape of the query names rather than their reputation. Tunnelling produces long, random-looking subdomain labels under one parent domain, queried repeatedly by a single process. Grouping by parent domain and process, and filtering for unusually long labels and high query counts, surfaces it reliably.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026