Does anyone know if there is a table that correlates to the local dnschache? I have been through schema 3.3.2 several times and must be reading over it. I basically want to query the dnscache to see if there are domains that the user/system has recently resolved and see if they match the IOCs I am targeting.
06/06/2019, 3:36 AM
06/06/2019, 4:52 PM
I I technically need all 3 - Linux, MAC and Windows - but I will take whatever I can get at this point.
06/07/2019, 4:41 AM
Not thru the dnscache but there is table created in PolyLogyx Extension (Windows only) that tracks all the DNS requests as well as resolutions..