Lion Cipher Lab
Hunt rare process-to-domain pairs in Sysmon DNS events (Event ID 22)
- SOC Analyst / Blue Team
- Advanced
- ~90 min
- Free · no account required
Why it matters
A DNS server log tells you that some computer asked for a domain. It cannot tell you which program on that computer asked, and that is usually the whole question: a browser looking up a strange domain is a Tuesday, while rundll32.exe or a copy of svchost.exe sitting in C:\Users\Public looking up a never-before-seen domain is an intrusion. Sysmon's Event ID 22 records the process behind every lookup, cached or not. That makes a cheap and powerful hunt possible: count how many machines in your fleet have ever seen each (process, domain) pair, and read the rare ones. Done naively, the hunt…
What you'll learn
- Reading Sysmon Event ID 22 (DNSEvent): Image, QueryName, QueryStatus, QueryResults
- Explaining what endpoint DNS telemetry tells you that DNS server and network logs cannot (which process asked)
- Stacking (least frequency of occurrence) across a fleet by registrable domain and by (process, domain) pair
- Normalizing image paths and domains so the stack counts the right thing
- Ranking a long tail by who is asking, and measuring analyst workload against malicious pairs found
- Naming the blind spots of EID 22: OS version, application-level resolvers and DoH, config filtering, undocumented QueryResults formatting
Steps in this lab
- What Event ID 22 knows that your DNS server does not
- Stacking in one paragraph: a hunt, not an alert
- Generate a week of DNS events from a 40-host fleet
- Stack it three ways and score each
- Read the three results like a hunter
- The honest miss: a phishing lookup ranked 345 of 345
- Blind spots: when a lookup never becomes an Event ID 22
- See a blind spot for yourself (optional, Windows with Sysmon)
- Run the same hunt on your own Sysmon data (optional)
- When to reach for this hunt, and how a pro does it better