Using Sysmon and ETW For So Much More

This post explains Sysmon v10's new DNS query logging (Event ID 22) and demonstrates how to combine Sysmon events (Process Create ID 1, Network Connect ID 3, and DNS ID 22) to detect LOLBAS abuse such as regsvr32.exe retrieving remote scriptlets; it includes example config snippets, detection recommendations, and guidance on filtering noise for enterprise threat hunting.