SysMon DNS Queries Occur from ipconfig - Again

Question

I had previously reported the issues of ipconfig making networking connections -> https://social.msdn.microsoft.com/Forums/en-US/49ad2190-2024-4585-9cf5-03488b1b1693/sysmon-dns-queries-occur-from-ipconfig?forum=windowsinternals

But it seems like a similar issue is back. We are using 13.32. I just noticed 13.33 just came out so I can try that as well but I figured I will post this for now.

Reposting from the old question which is nearly identical:

Dns query (rule: DnsQuery)
ipconfig.exe img.macromill[.]com

-
Dns query (rule: DnsQuery)
ipconfig.exe inv-nets.admixer[.]net
204.62.13.72
Dns query (rule: DnsQuery)
ipconfig.exe www.facebook[.]com

-
Dns query (rule: DnsQuery)
ipconfig.exe fm.flashtalking[.]com

-
Dns query (rule: DnsQuery)
ipconfig.exe pool.admedo[.]com

-
Dns query (rule: DnsQuery)
ipconfig.exe gameplay.intel[.]com

-
Dns query (rule: DnsQuery)
ipconfig.exe officehomeblobs.blob.core.windows[.]net

-

Answer 1

So funnily enough, we had an analyst do a deeper dive on this, and it appears that if the following command is run, it will make those DNS requests:

ipconfig.exe /displaydns

We did not realize that SysMon captured these as DNS events but it sort of makes sense. Can anyone confirm that the command above is properly triggering DNS requests?

We noticed our vulnerability scanner is what tripped this and before all of the DNS traffic, we saw the vulnerability scanner user running this command. Pretty interesting!