DNS Sysmon

[Thaynara Soares]

I installed sysmon in my AD and it is generating dns sysmon logs but these logs do not appear on the wazuh panel

Config local_rules

<group name="windows,sysmon,">
  <rule id="100023" level="4">
    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^22$</field>
    <description>Sysmon - Event 22: DNS Query event</description>
    <options>no_full_log</options>
    <group>sysmon_event_22,</group>
  </rule>
</group>

Log Sysmon

 <Event xmlns="*****">

- <System>

  <Provider Name="Microsoft-Windows-Sysmon" Guid="***" />

  <EventID>22</EventID>

  <Version>5</Version>

  <Level>4</Level>

  <Task>22</Task>

  <Opcode>0</Opcode>

  <Keywords>***</Keywords>

  <TimeCreated SystemTime="2024-08-01T19:13:38.674474200Z" />

  <EventRecordID>32857</EventRecordID>

  <Correlation />

  <Execution ProcessID="8704" ThreadID="9280" />

  <Channel>Microsoft-Windows-Sysmon/Operational</Channel>

  <Computer>***</Computer>

  <Security UserID="****" />

  </System>

- <EventData>

  <Data Name="RuleName">-</Data>

  <Data Name="UtcTime">2024-08-01 19:13:37.884</Data>

  <Data Name="ProcessGuid">***</Data>

  <Data Name="ProcessId">****</Data>

  <Data Name="QueryName">*****</Data>

  <Data Name="QueryStatus">0</Data>

  <Data Name="QueryResults">172.16.20.143;</Data>

  <Data Name="Image"****

  <Data Name="User">***</Data>

  </EventData>

  </Event>

[Luis Daniel Avendaño Larios]

Hi  Thaynara,

The DNS query events are already being triggered by rule 61650, If you want to get alerts of this event the correct way will be to create an overwrite of this rule. 

<group name="windows,sysmon">

  <rule id="61650" level="4" overwrite="yes">

    <if_sid>61600</if_sid>
    <field name="win.system.eventID">^22$</field>
    <description>Sysmon - Event 22: DNS Query event</description>
    <options>no_full_log</options>
    <group>sysmon_event_22,</group>
  </rule>

</group>

Reference: https://documentation.wazuh.com/current/user-manual/ruleset/rules/custom.html#changing-existing-rules

I hope this helps, let me know if you need anything else. 

Regards, 

Luis Avendaño.

[Thaynara Soares]

It worked, thank you