DNS resolver cache

Location & availability

Live Windows DNS client cache; inspect with Get-DnsClientCache

Entries expire and can be affected by many applications. Reading the cache is different from collecting historical DNS telemetry.

Fields to examine

• Record name, type and cached answer.
• Remaining TTL and record status where available.
• Collection time and examined host.

What it can establish

• Support that a name-resolution result was in the cache at collection.

What it cannot prove

• Prove a successful connection, download or exact visit time.
• Identify which process or human caused a query from cache content alone.

Use it in a screenshare

1. Record the collection time and inspect the existing cache without flushing it or querying suspect domains.
2. Preserve the relevant entries and remaining TTL as observed values.
3. Correlate with process-scoped DNS telemetry, browser records or network events before attributing the name to an application or session.

Worked example

A release host is cached while a browser is open. It may reflect background activity or an earlier lookup. The cache alone does not show that a tool was downloaded, launched or used in the match.

Cross-check the finding

• Browser history →Support a recorded visit-related entry in the examined browser profile.
• Sysmon event logs →Link configured process telemetry and subsequent events through ProcessGuid.
• Live network connections →Support an observed endpoint/state association with a process at collection.

Sources

• Microsoft — Get-DnsClientCache ↗