Detection rules › By event

Microsoft-Windows-Sysmon Event ID 22

71 detection rules reference this event. View event page.

Sigma (27)

AppX Package Installation Attempts Via AppInstaller.EXE severity medium T1105
Cloudflared Tunnels Related DNS Requests severity medium T1071, T1071.001, T1572
Diamond Sleet APT DNS Communication Indicators severity high
DNS HybridConnectionManager Service Bus severity high T1554
DNS Query by Finger Utility severity high T1059, T1059.003, T1071, T1071.004
DNS Query for Anonfiles.com Domain - Sysmon severity high T1567, T1567.002
DNS Query Request By QuickAssist.EXE severity low T1071, T1071.001, T1210
DNS Query Request By Regsvr32.EXE severity medium T1218, T1218.010, T1559, T1559.001
DNS Query Request To OneLaunch Update Service severity low T1056
DNS Query To AzureWebsites.NET By Non-Browser Process severity medium T1219, T1219.002
DNS Query To Common Malware Hosting and Shortener Services severity medium T1071, T1071.004
DNS Query To Devtunnels Domain severity medium T1071, T1071.001, T1572
DNS Query To Katz Stealer Domains severity high T1071, T1071.004
DNS Query To MEGA Hosting Website severity medium T1567, T1567.002
DNS Query To Remote Access Software Domain From Non-Browser App severity medium T1219, T1219.002
DNS Query To Ufile.io severity low T1567, T1567.002
DNS Query To Visual Studio Code Tunnels Domain severity medium T1071, T1071.001
DNS Query Tor .Onion Address - Sysmon severity high T1090, T1090.003
DNS Server Discovery Via LDAP Query severity low T1482
DPRK Threat Actor - C2 Communication DNS Indicators severity high
Notepad++ Updater DNS Query to Uncommon Domains severity medium T1195, T1195.002, T1557
Potential Compromised 3CXDesktopApp Beaconing Activity - DNS severity high
Potential SocGholish Second Stage C2 DNS Query severity high T1219, T1219.002
Suspicious Cobalt Strike DNS Beaconing - Sysmon severity critical T1071, T1071.004
Suspicious DNS Query for IP Lookup Service APIs severity medium T1590
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing severity high T1187, T1557, T1557.001
TeamViewer Domain Query By Non-TeamViewer Application severity medium T1219, T1219.002

Elastic (3)

External IP Lookup from Non-Browser Process severity low building block T1016, T1016.001, T1614
First Time Seen DNS Query to RMM Domain severity medium T1219, T1219.002
MsBuild Making Network Connections severity medium T1071, T1127, T1127.001

Splunk (23)

3CX Supply Chain Attack Network Indicators severity medium T1195, T1195.002
AteraAgent Installation - Windows (Sysmon) T1219
Detect DNS Query to Decommissioned S3 Bucket severity low T1485
Detect hosts connecting to dynamic domain providers severity medium T1189
Detect Remote Access Software Usage DNS severity low T1219
DNS Kerberos Coercion severity medium T1071, T1071.004, T1187, T1557, T1557.001
DNS Query Length With High Standard Deviation severity low T1048, T1048.003
Local LLM Framework DNS Query T1590
Ngrok Reverse Proxy on Network severity low T1090, T1102, T1572
Rundll32 DNSQuery severity medium T1218, T1218.011
Sunburst Correlation DLL and Network Event severity medium T1203
Suspicious Process DNS Query Known Abuse Web Services severity medium T1059, T1059.005
Suspicious Process With Discord DNS Query severity low T1059, T1059.005
Wermgr Process Connecting To IP Check Web Services severity medium T1590, T1590.005
Windows Abused Web Services severity low T1102
Windows AI Platform DNS Query severity low T1071, T1071.004
Windows BitLockerToGo with Network Activity T1218
Windows DNS Query Request by Telegram Bot API severity low T1071, T1071.004, T1102, T1102.002
Windows DNS Query Request To TinyUrl severity low T1105
Windows Gather Victim Network Info Through Ip Check Web Services severity low T1590, T1590.005
Windows Multi hop Proxy TOR Website Query severity low T1071, T1071.003
Windows Spearphishing Attachment Connect To None MS Office Domain T1566, T1566.001
Windows Visual Basic Commandline Compiler DNSQuery severity medium T1071, T1071.004

Kusto (11)

Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution) severity medium T1008, T1568, T1573
Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution) severity medium T1008, T1568
DNS events related to mining pools (ASIM DNS Schema) severity low T1496
DNS events related to ToR proxies (ASIM DNS Schema) severity low T1048
Excessive NXDOMAIN DNS Queries (ASIM DNS Schema) severity medium T1008, T1568
Google Threat Intelligence - Threat Hunting Domain severity medium T1071
Ngrok Reverse Proxy on Network (ASIM DNS Solution) severity medium T1090, T1102, T1572
Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Static threshold based (ASIM DNS Solution) severity medium T1008, T1568
Rare client observed with high reverse DNS lookup count - Anomaly based (ASIM DNS Solution) severity medium T1590
Rare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution) severity medium T1590
RecordedFuture Threat Hunting Domain All Actors severity medium T1566, T1568

YARA-L (7)

DNS Query To Recently Created Domain severity low
Domain Prevalence severity low
IOC Domain C2 severity high
IOC Domain Internal Policy severity low
Recon Environment Enumeration Network CISA Report severity low T1016
VT Relationships File Contacts Domain severity high
WHOIS DNS Query To Typesquatting Domain severity low

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-Sysmon Event ID 22

Sigma (27)

Elastic (3)

Splunk (23)

Kusto (11)

YARA-L (7)

Keyboard shortcuts

Search operators