Using native functionality in Windows, the best method would be to enable Audit Filtering Platform Connection. It can log all connections allowed by the Windows Firewall. The following is an excerpt:
Audit Filtering Platform Connection determines whether the operating
system generates audit events when connections are allowed or blocked
by the Windows Filtering Platform.
Windows Filtering Platform (WFP) enables independent software vendors
(ISVs) to filter and modify TCP/IP packets, monitor or authorize
connections, filter Internet Protocol security (IPsec)-protected
traffic, and filter remote procedure calls (RPCs).
This subcategory contains Windows Filtering Platform events about
blocked and allowed connections, blocked and allowed port bindings,
blocked and allowed port listening actions, and blocked to accept
incoming connections applications.
The downside with enabling this auditing is the audit volume will be HIGH. Can't stress that enough.
From here you'll need a custom script or some other means to aggregate the DNS query logs and the Windows Filtering Platform (WFP) events to determine what IP addresses were accessed without performing a DNS lookup.
For example,
- Build list of all unique destination IP addresses for a host.
- Search DNS replies to that host for IP addresses from #1.
What you're aiming to achieve is difficult. Some application may use hard-coded IP addresses or other means to resolve a destination (NetBIOS, WINS, LLMNR, Bonjour, etc.). Depending on your environment, don't be surprised to find a number of false-positives during your investigation.
As an alternative, place a network monitoring device in front of the target system(s). Products such as Zeek (formerly Bro), Argus, SiLK, or RITA would all log network connections, in addition to other interesting data, and don't cost any money. In some instances they will even log DNS queries. This alternative approach will still require a custom script to aggregate the DNS query logs with network connections to find which were established without using traditional DNS.