drop dns debug log csv or sysmon dns evtx csv · detect gaps in dns resolution logging · identify windows where dns activity was not recorded · surface dns logging disable events · runs locally
artifacts
drop dns debug log / sysmon 22 / dns-client csv / registry
or click
gaps >10m suspicious · cross-ref sysmon 3 network during dns silence · LogLevel=0 / dnscmd disable
drop dns debug log csv · sysmon 22 csv · dns-client operational csv · optional registry