Find the responsible application in Windows for making malicious DNS requests

[Arman_Zaheri]

Hello everybody,

I sometimes receive alerts from our firewall blocking a malicious DNS request, but when I want to track it to the application that made that request, I just see Windows DNS cache service. Is there any way to audit specific DNS requests e.g. "gyoutube.com" ,which is actually malicious, in a Windows client using Cortex or other tools and find exactly which process made that request?

Many thanks,

[jmazzeo · Accepted solution]

Hi @Arman_Zaheri, thanks for reaching us using the Live Community.

Try this XQL Query with your required data:

dataset = xdr_data
| filter agent_hostname = "Your_Hostname" //If needed
| filter event_type = ENUM.STORY 
| filter dns_query_name contains "microsoft" // Set your domain to search
| fields agent_hostname, agent_ip_addresses, actor_process_image_name, actor_process_image_path, causality_actor_process_command_line, dns_query_name 

Please let us know how it goes.

If this post answers your question, please mark it as the solution.

[Arman_Zaheri]

Hello again,

@jmazza many thanks for the quick and correct answer. I was using the following query before that utilizes "network_story" preset and usually I could find DNS requests made by a host, but not the latter one  mentioned. What's the difference between using this preset and xdr_data in this case?

preset= network_story
| filter (dns_query_name != null)
| arrayexpand dns_resolutions
| filter (dns_query_name contains "gyoutube")