How to intercept and manipulate DNS queries?

How about creating a DNS entry for "expenses.mycompany.com" that sends to a webserver with a redirect rule of expenses.mycompany.com -> mycompany.com/expenses?

As long as clients have a DNS suffix of "mycompany.com" set they will convert "expenses" into expenses.mycompany.com, and hit that webserver.

It means a few extra DNS entries, and some virtual hosts on the webserver that do nothing but redirect to the "real" URLs?

While not exactly what you're after, why not use a URL shortener on your internal servers? Then you can setup a virtual host on your server that hosts the URL shortener, and do something like:

http://go/expenses
http://go/tracker

The URL shortener would rewrite that to your necessary internal URL. There is an example of a .NET URL Shortener here.

The other alternative is as mfarver says, you'll need to setup a DNS record pointing to a host that reads the host header requests, and redirects appropriately. This would need to be done via a URL Rewrite rule in IIS (or apache if you want to run it on windows), or some code to do all the work for you. They both do essentially the same thing as the URL shortener.