In Sysmon 10.0, Microsoft added the ability to monitor DNS queries and the executable that performed the query. This event needs to be enabled through a configuration file with the DNSQuery directive.

Every time a query is made to a website, the request goes to the Domain Name System (DNS) which converts the alphabetic name into the server's numeric IP address. For example, when you type the ...