Prerequisite: Please see this post Why understanding of DNS monitoring is useful for securing and hardening infrastructure published earlier in 2019

Logging DNS queries are a valuable data source used in networks in order to help incident response, and discover for indicators of compromise (intrusion discovery). However, these transactions are noisy and can take up significant space. Log collection and log centralization will funnel these valuable logs into a processing and analytics system to enable specialists to gain insights into valuable security scenarios. Beyond that, log centralization protects the integrity of the data should the DNS server be compromised as part of counter incident-response efforts.

Finding Queries on DNS Debug Logs

The DNS debug file contains information on DNS queries and activity that informs of any signs of malicious traffic. The message logging key (for packets - other items use a subset of these fields) for DNS debug logging will provide information of the following:

	Field #  Information         Values
	-------  -----------         ------
	   1     Date
	   2     Time
	   3     Thread ID
	   4     Context
	   5     Internal packet identifier
	   6     UDP/TCP indicator
	   7     Send/Receive indicator
	   8     Remote IP
	   9     Xid (hex)
	  10     Query/Response      R = Response
	                             blank = Query
	  11     Opcode              Q = Standard Query
	                             N = Notify
	                             U = Update
	                             ? = Unknown
	  12     [ Flags (hex)
	  13     Flags (char codes)  A = Authoritative Answer
	                             T = Truncated Response
	                             D = Recursion Desired
	                             R = Recursion Available
	  14     ResponseCode ]
	  15     Question Type
	  16     Question Name

Once DNS log collection is set up, administrators must write configurations to parse these logs in order to extract the fields from each record. Since original data will be in a single-line log format, parsing allows for additional consumption in other software.

Finding DNS Queries with Sysmon Event ID 22

See my previous post here for more information.

This series is from some of the braindump and notes that I have collected while researching DNS back in 2019. I have decided to share these notes out. Of course, the RFC series and implementations are the source of information of these notes.