# Suspicious DNS Query

**ID**: S1003

**Description**: A DNS query to an unexpected domain can be an indicator of abnormal activity on a host. If a domain has been marked as malicious, an investigator may be tasked with determining what caused the DNS query (or response) and if it indicates the host has been compromised.

## What application was responsible for the DNS query? <span class="dfiqIdTag">F1004</span>
What application made a DNS request is important for determining if it is likely legitimate or not. The source also impacts further investigative steps (depending on if `powershell.exe` or `chrome.exe` were responsible, different artifacts would be useful).

 - <a href="/questions/Q1018"><span class="dfiqIdTag">Q1018</span> &nbsp;What process made the DNS query?</a>
 - <span class="dfiqIdTag">Q1073</span> &nbsp;Have there been any modifications to the "hosts" file?
## Was a user's web browsing the cause of a given DNS query? <span class="dfiqIdTag">F1005</span>
Understanding if a user's actions in a web browser caused a particular DNS query is valuable context when investigating a suspicious DNS query. If the query is related to the user's actions, closer scrutiny of their browser activity may make sense. If the DNS doesn't appear related, you may need to look into the actions of other non-browser processes.

 - <a href="/questions/Q1019"><span class="dfiqIdTag">Q1019</span> &nbsp;What web browsers were running at a given time?</a>
 - <a href="/questions/Q1020"><span class="dfiqIdTag">Q1020</span> &nbsp;What pages did web browsers visit?</a>
 - <a href="/questions/Q1024"><span class="dfiqIdTag">Q1024</span> &nbsp;Was an Incognito/Private browser session used?</a>
 - <span class="dfiqIdTag">Q1072</span> &nbsp;Did Chrome's DNS Prefetching cause a DNS query?
## Was a browser extension responsible for a DNS query? <span class="dfiqIdTag">F1006</span>
A malicious (or potentially unwanted) extension may generate DNS queries itself, inject or modify legitimate requests, or manipulate the user's browsing experience in some other way.

 - <span class="dfiqIdTag">Q1021</span> &nbsp;What Chrome extensions are installed?
 - <span class="dfiqIdTag">Q1022</span> &nbsp;What actions did a Chrome extension perform?
 - <span class="dfiqIdTag">Q1023</span> &nbsp;Is a given Chrome extension associated with a given domain?
