From 69a575e7dc55b6f91acd0094bd1afa5d251d347a Mon Sep 17 00:00:00 2001
From: Dray Agha <44196051+Purp1eW0lf@users.noreply.github.com>
Date: Fri, 1 Mar 2024 12:02:47 +0000
Subject: [PATCH] Adding EID22/DNS details

Just some extra output for the DNS addresses being queried. Has proved useful when monitoring for RATs and C2 beacons.

Been meaning to add this for a while, made the edit on my local copy and never added to main repo lol.
---
 PowerSiem.ps1 | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/PowerSiem.ps1 b/PowerSiem.ps1
index ae81336..919f648 100644
--- a/PowerSiem.ps1
+++ b/PowerSiem.ps1
@@ -177,7 +177,10 @@ while ($true)
         if ($evt.id -eq 22) {
             $output = @{}
             $output.add("Type", "DNS Query")
-            write-alert $output
+		    $output.add("ProcessId", $evt.ProcessId)
+	        $output.add("Image", $evt.Image)
+		    $output.add("QueryName", $evt.QueryName) # Adding the DNS query name
+		    write-alert $output
         }
         if ($evt.id -eq 23) {
             $output = @{}