diff --git a/sysmonconfig.xml b/sysmonconfig.xml
index c000c52..b8e1f70 100644
--- a/sysmonconfig.xml
+++ b/sysmonconfig.xml
@@ -1,5 +1,6 @@
 <Sysmon schemaversion="4.90">
   <EventFiltering>
     <ProcessCreate onmatch="exclude"/>
+    <DnsQuery onmatch="include"/>
   </EventFiltering>
 </Sysmon>