Sysmon Event 22 DNS anomaly detection

Sysmon config: <DnsQuery onmatch='exclude'><QueryName condition='end with'>.corp.local</QueryName></DnsQuery>

Configure Sysmon Event 22 (DNS query) to detect anomalous DNS queries that reveal Kerberos over TLS and service discovery.

Enable Event 22 when you want to see which domains your endpoints query: the DNS query is the first signal of many techniques — DC discovery (SRV _kerberos, _ldap), Kerberos over TLS attempts (CVE-2024-49113 and modern relay tools query _kerberos._tcp and _ldap._tcp.dc._msdcs anomalously), and DNS C2. The config with onmatch='exclude' and the internal domain suffix removes legitimate noise; what remains — queries to rare external domains, internal SRV from non-domain hosts, unusual volumes — is the signal. It's one of the detection layers that catches the most real cases because DNS cannot be fully encrypted and almost no one monitors it.

Do not use it on hosts without a defined resolution policy: if endpoints query external resolvers (8.8.8.8) or there are legitimate third-party domains (SaaS, CDNs), Event 22 without a baseline is a waterfall of noise. DNS C2 detection (dnscat2, iodine) is not seen with just the event: you need volume analysis and DGA analysis on the logs. And watch out for performance: Event 22 is one of the most prolific Sysmon events; config with domain and resolver exclusions is mandatory before enabling it in a large environment.