Tracing DNS Queries on Your Windows DNS Server

This report documents a practical attack and detection workflow where an attacker deployed a wildcard DNS record and used Responder to poison DNS lookups, resulting in domain compromise of a privileged account; it then walks through enabling Windows Server DNS debug logging (Server 2012+), capturing and parsing detailed DNS traces, and using a PowerShell parser to identify hosts querying for non-existent records that were resolved to a chosen wildcard IP. The post includes operational cautions about logging impact, recommends choosing a unique wildcard IP, and suggests follow-up steps such as enabling Sysmon DNS query logging and feeding summarized logs to a SIEM for ongoing detection and mitigation.