Event 22 DNS Query issue - not generating event from browsers

[patzak88]

Event 22 DNS Query issue - not generating event from browsers

[taherkaraki]

Your browser has a proxy most likely, so the proxy resolved the dns instead

[patzak88]

Hello @taherkaraki ,

Thank you for your feedback. Its not this. I don`t have any proxy set. I forgot to mention that all of the machines which I have tested on are newly installed (fresh Windows).

Must be something else but I didn`t yet figure it out what it is.

[taherkaraki]

Run wireshark and see if you have any dns traffic

[patzak88]

@taherkaraki - I tested it with wireshark. ran capture, accessed websites, including below apple.com, and it shows the DNS traffic:

but on the sysmon operational event viewer logs - no sign of them

[taherkaraki]

Are you sure your sysmon config does not exclude the browser?

[patzak88]

Are you sure your sysmon config does not exclude the browser?

@taherkaraki i'm using the swifton config. I changed nothing in it.

[taherkaraki]

Comment From config:

	<!--OPERATIONS:	Chrome and Firefox prefetch DNS lookups, or use alternate DNS lookup methods Sysmon won't capture. You need to turn these off.
					Search for Group Policy for these browsers to configure this.-->

[patzak88]

@taherkaraki - disabled the DNS lookup setting in edge (Use secure DNS to specify how to lookup the network address for websites) and still no sign in Sysmon operational of the DNS records from websites I`m accessing.

[patzak88]

later update: it turns out that from firefox I receive every DNS query in Event Viewer. the problem seems to be in edge and chrome. did checked the proxy settings, DNS lookup - nothing which can solve this

[pulpon6]

Same issue, Is there a solution?