Sysmon DNS query is not working

Question

I am using Sysmon v15 with Windows 11 22H2.

After installation, I tried to ping a domain from the command prompt and also using the Edge browser. I was expecting to see Event ID 22 in my Microsoft-Windows-Sysmon/Operational log. I can see other events but no event 22 showing up.

When I run sysmon -c, i get the following output.

Current configuration:

- Service name: Sysmon64

- Driver name: SysmonDrv

- Config file: C:\Users\user1\Downloads\Sysmon64.exe -i

- HashingAlgorithms: SHA256

- Network connection: disabled

- Archive Directory: -

- Image loading: disabled

- CRL checking: enabled

- DNS lookup: enabled

Any ideas why my DNS lookup is not being logged by Sysmon?

Answer 1

It looks like you might have left the

    <EventFiltering>
        <DnsQuery onmatch="exclude" />
    </EventFiltering>

part out of the config. The .\ sysmon64.exe -c output should contain

...
 - DNS lookup:                    enabled

Rule configuration (version 4.90):
...
 - DnsQuery                           onmatch: exclude   combine rules using 'And'
...

for that XML snippet from above.

Answer 2

oh thats nice work, but how can it will solve I don't have any idea