Collecting DNS Lookups on macOS with osquery

说明与用途

在 macOS 上通过自定义 osquery 扩展和 MDM 配置文件实现了 DNS 事件的明文收集，实现了持续监控且资源占用低。

问题

Need to capture DNS resolution events on macOS endpoints in plaintext, regardless of upstream DNS server, without relying on corporate DNS logs or third‑party services.

结果

Plaintext DNS events are now captured continuously on macOS endpoints without high resource consumption, enabling threat hunting and IOC checks locally.

工作流

• 1. Explore existing osquery tables for DNS data.
• 2. Write a custom osquery extension to read mDNSResponder logs.
• 3. Create a configuration profile (dns.mobileconfig) to enable private‑data logging for com.apple.mdns and com.apple.mDNSResponder.
• 4. Apply the profile to endpoints.
• 5. Verify domain and answer fields are plaintext in logs.
• 6. Deploy the custom osquery extension via FleetDM or similar.
• 7. Monitor osquery_schedule for resource usage and adjust thresholds if needed.

证据

Both the domain name and the answer are masked. Apple's log privacy protection.

来源

To expose plaintext values in newly collected events, I applied a configuration profile that enables private-data logging for the com.apple.mdns and com.apple.mDNSResponder subsystems.

来源

Three issues became apparent: DNS resolution generates a large number of events. Querying unified_log can consume substantial CPU and memory. unified_log is not an evented table.

来源