From 5cc74a5fce7fc82901f870df2f3c39904b92a678 Mon Sep 17 00:00:00 2001
From: Bob Sponge <b-sponge@krusty.local>
Date: Sat, 21 Feb 2026 12:04:18 +0000
Subject: [PATCH] log DNS queries after the beacon finding

---
 sysmonconfig.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig.xml b/sysmonconfig.xml
index c000c52..b8e1f70 100644
--- a/sysmonconfig.xml
+++ b/sysmonconfig.xml
@@ -1,5 +1,6 @@
 <Sysmon schemaversion="4.90">
   <EventFiltering>
     <ProcessCreate onmatch="exclude"/>
+    <DnsQuery onmatch="include"/>
   </EventFiltering>
 </Sysmon>