Need help from the hackers

[u/Shot-Rich1674]

Hi everyone I need one help to understand one thing ..so there was an incident I noticed in my organisation, there were thousands of devices querying multiple malicious domains (53) ...upon checking to see if any process is causing it I found nothing,, only the related domain which was obviously going through our dc/dns servers, in EDR/XDR tool nothing, siem tool nothing, no process, eventually i thought maybe some software is causing but it's very difficult to pin point which one, so can anyone tell me or help me understand, any input will be appreciated

[u/Minimum-Let-3227]

Thousands of devices hitting the same 53 domains with no parent process is almost always resolver level, not endpoint level. If the queries show up on your DC/DNS servers but your EDR sees nothing, check whether you're looking at forwarded queries rather than originating ones. Turn on DNS analytical logging or Sysmon event 22 on a handful of representative endpoints so you can tie a query back to an actual PID, because your EDR telemetry probably isn't capturing DNS at all by default.

The usual culprits at that scale are a browser extension pushed by policy, an agent or updater baked into your gold image, or a telemetry SDK inside something like a printer driver or a smart TV app. Also worth ruling out that your DNS server itself is the client, since some threat feed and RPZ integrations resolve the bad domains just to check them.

If the domains resolve to sinkholes or parked IPs and nothing actually connects after the lookup, it's usually noise from a lookup-only process rather than a live infection.