Collecting DNS Lookups on macOS with osquery

Описание и применение

На macOS реализован сбор DNS‑запросов в открытом виде через osquery, используя расширение и профиль MDM, что обеспечивает непрерывный мониторинг без высокого потребления ресурсов.

Задача

Need to capture DNS resolution events on macOS endpoints in plaintext, regardless of upstream DNS server, without relying on corporate DNS logs or third‑party services.

Результат

Plaintext DNS events are now captured continuously on macOS endpoints without high resource consumption, enabling threat hunting and IOC checks locally.

Рабочий процесс

• 1. Explore existing osquery tables for DNS data.
• 2. Write a custom osquery extension to read mDNSResponder logs.
• 3. Create a configuration profile (dns.mobileconfig) to enable private‑data logging for com.apple.mdns and com.apple.mDNSResponder.
• 4. Apply the profile to endpoints.
• 5. Verify domain and answer fields are plaintext in logs.
• 6. Deploy the custom osquery extension via FleetDM or similar.
• 7. Monitor osquery_schedule for resource usage and adjust thresholds if needed.

Доказательства

Both the domain name and the answer are masked. Apple's log privacy protection.

Источник

To expose plaintext values in newly collected events, I applied a configuration profile that enables private-data logging for the com.apple.mdns and com.apple.mDNSResponder subsystems.

Источник

Three issues became apparent: DNS resolution generates a large number of events. Querying unified_log can consume substantial CPU and memory. unified_log is not an evented table.

Источник