topic Re: Find the responsible application in Windows for making malicious DNS requests in Cortex XDR Discussions

Find the responsible application in Windows for making malicious DNS requests

Arman_Zaheri — Wed, 26 Jun 2024 06:40:53 GMT

Hello everybody,

I sometimes receive alerts from our firewall blocking a malicious DNS request, but when I want to track it to the application that made that request, I just see Windows DNS cache service. Is there any way to audit specific DNS requests e.g. "gyoutube.com" ,which is actually malicious, in a Windows client using Cortex or other tools and find exactly which process made that request?

Many thanks,

Re: Find the responsible application in Windows for making malicious DNS requests

jmazzeo — Wed, 26 Jun 2024 13:44:21 GMT

Hi @Arman_Zaheri, thanks for reaching us using the Live Community.

Try this XQL Query with your required data:

dataset = xdr_data | filter agent_hostname = "Your_Hostname" //If needed | filter event_type = ENUM.STORY | filter dns_query_name contains "microsoft" // Set your domain to search | fields agent_hostname, agent_ip_addresses, actor_process_image_name, actor_process_image_path, causality_actor_process_command_line, dns_query_name

Please let us know how it goes.

If this post answers your question, please mark it as the solution.

Re: Find the responsible application in Windows for making malicious DNS requests

Arman_Zaheri — Thu, 27 Jun 2024 06:03:04 GMT

Hello again,

@jmazza many thanks for the quick and correct answer. I was using the following query before that utilizes "network_story" preset and usually I could find DNS requests made by a host, but not the latter one mentioned. What's the difference between using this preset and xdr_data in this case?

preset= network_story | filter (dns_query_name != null) | arrayexpand dns_resolutions | filter (dns_query_name contains "gyoutube")