etw-dns

KO | EN

gitlite — search

#javascript #llm #golang #go #machine-learning #deep-learning #nodejs #java #kubernetes #vue #awesome-list #pytorch #openai #open-source

(★ 30)

A simple example application to collect DNS queries logs using etw-api

etw-dns Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# etw-dns
Simple Windows console application that listen for DNS resolutions events using the [ETW Win32 API](https://docs.microsoft.com/en-us/windows/win32/etw/event-tracing-portal).

The application opens a real time event session and register to the Microsoft-Windows-DNS-Client providers to wait for DNS related events.
It generates two log files `app.log` with application specific logs and `audit.log` where it write every query performed in the OS.

It also store some statistics and print them out to stdout every 5 seconds and when finishing the application, with a summary of the total queries intercepted, the top 10 most resolved domains and the top 10 most active process resolving DNS queries.

## app.log output example
```
[INFO][2020-04-24.13:54:53] - Starting Agentx Application
[INFO][2020-04-24.13:54:53] - Starting Microsoft-Windows-DNS-Client sensor
[INFO][2020-04-24.13:54:53] - Event trace session succesfully started
[INFO][2020-04-24.13:54:53] - Event provider succesfully enabled in event trace session.
[INFO][2020-04-24.13:54:53] - Sensor Microsoft-Windows-DNS-Client started.
[DEBUG][2020-04-24.13:54:55] - Event ID: 3006
[DEBUG][2020-04-24.13:54:55] - Event Time: 04/24/2020 13:54:53.548885500
[DEBUG][2020-04-24.13:54:55] - Received DNS Event generated by ProcessId: 16388
[DEBUG][2020-04-24.13:54:55] - QueryName: checkappexec.microsoft.com performed by [16388] smartscreen.exe
[DEBUG][2020-04-24.13:54:55] - Event ID: 3006
[DEBUG][2020-04-24.13:54:55] - Event Time: 04/24/2020 13:54:53.548924100
[DEBUG][2020-04-24.13:54:55] - Received DNS Event generated by ProcessId: 16388
[DEBUG][2020-04-24.13:54:55] - QueryName: checkappexec.microsoft.com performed by [16388] smartscreen.exe
[DEBUG][2020-04-24.13:54:55] - Event ID: 3008
[DEBUG][2020-04-24.13:54:55] - Event Time: 04/24/2020 13:54:53.548930700
[DEBUG][2020-04-24.13:54:55] - Received DNS Event generated by ProcessId: 16388
[DEBUG][2020-04-24.13:54:55] - QueryName: checkappexec.microsoft.com performed by [16388] smartscreen.exe
```

## audit.log output example
```
[AUDIT][2020-04-24.13:54:55] - QueryName: checkappexec.microsoft.com performed by [16388] smartscreen.exe
[AUDIT][2020-04-24.13:54:55] - QueryName: checkappexec.microsoft.com performed by [16388] smartscreen.exe
[AUDIT][2020-04-24.13:54:55] - QueryName: checkappexec.microsoft.com performed by [16388] smartscreen.exe
```

## Statistics Summary
```
DNS Sensor Info
{
        Total Queries Received: 103
        Total Process Generating Queries: 6
        TOP Most Queried Domains:
                26% - vortex.data.microsoft.com : 27
                19% - checkappexec.microsoft.com : 20
                13% - presence.teams.microsoft.com : 14
                13% - play.google.com : 14
                13% - drive.google.com : 14
                8% - wpad : 9
                4% - clients4.google.com : 5
        TOP Most Active Process:
                76% - [PID: 3068] : 79
                7% - [PID: 8128] : 8
                5% - chrome.exe : 6
                3% - smartscreen.exe : 4
                3% - [PID: 16060] : 4
                1% - Teams.exe : 2
}
```
## Running the application
To start the application just run the compiled process as an Administrator, to stop collecting logs just use CTRL+C

## Compiling
A Visual Studio 2019 solution and project is available within the source code, just use it to compile the project.

## Limitations and assumptions
The DNS Provider UUID is hardcoded and should be the same across all Windows versions, but in case it registered internally with a different UUID this wont work out of the box as this value needs to be updated.
The application opens a real time mode trace session, so keep in mind this note taken from MS docs:
> Only users with administrative privileges, users in the Performance Log Users group, and applications running as LocalSystem, > LocalService, NetworkService can consume events in real time. To grant a restricted user the ability to consume events in real time, add them to the Performance Log Users group

etw-dns

etw-dns Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

etw-dns

etw-dns Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README