https://github.com/osquery/osquery logo
Title
s

Staples

06/05/2019, 5:28 PM
Does anyone know if there is a table that correlates to the local dnschache? I have been through schema 3.3.2 several times and must be reading over it. I basically want to query the dnscache to see if there are domains that the user/system has recently resolved and see if they match the IOCs I am targeting.
o

OpenPlgx

06/06/2019, 3:36 AM
Which OS?
s

Staples

06/06/2019, 4:52 PM
I I technically need all 3 - Linux, MAC and Windows - but I will take whatever I can get at this point.
o

OpenPlgx

06/07/2019, 4:41 AM
Not thru the dnscache but there is table created in PolyLogyx Extension (Windows only) that tracks all the DNS requests as well as resolutions..
s

Staples

06/07/2019, 5:19 PM
I'll have to look into that. Thanks!