Collecting DNS Lookups on macOS with osquery

Description and use

Implemented plaintext DNS event collection on macOS via a custom osquery extension and MDM profile, enabling continuous monitoring without high resource usage.

Problem

Need to capture DNS resolution events on macOS endpoints in plaintext, regardless of upstream DNS server, without relying on corporate DNS logs or third‑party services.

Outcome

Plaintext DNS events are now captured continuously on macOS endpoints without high resource consumption, enabling threat hunting and IOC checks locally.

Workflow

• 1. Explore existing osquery tables for DNS data.
• 2. Write a custom osquery extension to read mDNSResponder logs.
• 3. Create a configuration profile (dns.mobileconfig) to enable private‑data logging for com.apple.mdns and com.apple.mDNSResponder.
• 4. Apply the profile to endpoints.
• 5. Verify domain and answer fields are plaintext in logs.
• 6. Deploy the custom osquery extension via FleetDM or similar.
• 7. Monitor osquery_schedule for resource usage and adjust thresholds if needed.

Evidence

Both the domain name and the answer are masked. Apple's log privacy protection.

Source

To expose plaintext values in newly collected events, I applied a configuration profile that enables private-data logging for the com.apple.mdns and com.apple.mDNSResponder subsystems.

Source

Three issues became apparent: DNS resolution generates a large number of events. Querying unified_log can consume substantial CPU and memory. unified_log is not an evented table.

Source