A malicious code was querying a hard-coded DNS server instead of system DNS even that was not registering with system

Question

A malicious code was querying a
hard-coded DNS server instead of system DNS even that was not registering with system. We could see the queries
at the network level (Packetbeat logs). Can you please throw some light on it?

Answer 1

Hi ,

Please understand, Packetbeat is a third-party tool which we are not familiar with it. You can use Wireshark or network monitor to collect network traces and get more details about the source of those queries.

You can download network monitor via following link:

https://www.microsoft.com/en-sg/download/details.aspx?id=4865

For how to collect data using Network Monitor, you can refer to the following artilce:

https://learn.microsoft.com/en-us/windows/client-management/troubleshoot-tcpip-netmon

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

It is also visible in Wireshark .It is being captured by wireshark but not by sysmon

Answer 3

Hi ,

Good morning! I have truly understand your question. In fact, this is related with sysmon's working mechanism. Network monitor and Wireshark are using an NDIS (Network Driver Interface Specification) filter driver, so they can filter traffic.

Based on my understanding, sysmon is monitoring windows related service. ping and tracert will call Dnscahe service, while Nslookup doesn't use the client's DNS cache. So DNS query for instance web browsers, FileZilla, WinSCP, ping, tracert, etc can be monitored. DNS lookups using nslookup cannot be monitored by sysmon because it is not calling Dnscahe service.

About malicious code DNS querying you posted, it probably didn't call windows related service, so it cannot be monitored by sysmon.

In short, we always using Network monitor and Wireshark to monitor network related traffic.

Hope this can hep you.

Note: since this is a public forum, everyone could view your information, please remove private information that might leak your privacy.

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.