Windows DNS Queries to Remote Access/Remote Support Domains From Non-Browser Processes

Alert on DNS lookups for remote access service domains from non-browser executables, including RustDesk subdomains.

FreeUnreviewedSigmamediumv1

windows-dns-queries-to-remote-access-remote-support-domains-from-non-browser-pro-4d07b1f4

title: Windows DNS Queries to Remote Access/Remote Support Domains From Non-Browser Processes
id: e7c50755-7be6-48f1-be90-b4434f7a60b8
related:
  - id: 71ba22cb-8a01-42e2-a6dd-5bf9b547498f
    type: obsolete
  - id: 7c4cf8e0-1362-48b2-a512-b606d2065d7d
    type: obsolete
  - id: ed785237-70fa-46f3-83b6-d264d1dc6eb4
    type: obsolete
  - id: 4d07b1f4-cb00-4470-b9f8-b0191d48ff52
    type: derived
status: test
description: This rule flags Windows DNS queries where the query name ends with domains associated with common remote access and remote support software, or matches a RustDesk DNS pattern. It matters because adversaries can use legitimate remote access tools to blend in while establishing command-and-control or interactive session connectivity. The detection relies on DNS query telemetry (query names) and process image context to exclude traffic generated by common web browsers.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-6---ammyy-admin-software-execution
  - https://redcanary.com/blog/misbehaving-rats/
  - https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
  - https://blog.sekoia.io/scattered-spider-laying-new-eggs/
  - https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist#disable-quick-assist-within-your-organization
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml
author: frack113, Connor Martin, Huntrule Team
date: 2022-07-11
modified: 2024-12-17
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: dns_query
detection:
  selection_generic:
    QueryName|endswith:
      - agent.jumpcloud.com
      - agentreporting.atera.com
      - ammyy.com
      - api.parsec.app
      - api.playanext.com
      - api.splashtop.com
      - app.atera.com
      - assist.zoho.com
      - authentication.logmeininc.com
      - beyondtrustcloud.com
      - cdn.kaseya.net
      - client.teamviewer.com
      - comserver.corporate.beanywhere.com
      - control.connectwise.com
      - downloads.zohocdn.com
      - dwservice.net
      - express.gotoassist.com
      - getgo.com
      - getscreen.me
      - integratedchat.teamviewer.com
      - join.zoho.com
      - kickstart.jumpcloud.com
      - license.bomgar.com
      - logmein-gateway.com
      - logmein.com
      - logmeincdn.http.internapcdn.net
      - n-able.com
      - net.anydesk.com
      - netsupportsoftware.com
      - parsecusercontent.com
      - pubsub.atera.com
      - relay.kaseya.net
      - relay.screenconnect.com
      - relay.splashtop.com
      - remoteassistance.support.services.microsoft.com
      - remotedesktop-pa.googleapis.com
      - remoteutilities.com
      - secure.logmeinrescue.com
      - services.vnc.com
      - static.remotepc.com
      - swi-rc.com
      - swi-tc.com
      - tailscale.com
      - telemetry.servers.qetqo.com
      - tmate.io
      - twingate.com
      - zohoassist.com
  selection_rustdesk:
    QueryName|endswith: .rustdesk.com
    QueryName|startswith: rs-
  filter_optional_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_safari:
    Image|endswith: \safari.exe
  filter_optional_defender:
    Image|endswith:
      - \MsMpEng.exe
      - \MsSense.exe
  filter_optional_brave:
    Image|endswith: \brave.exe
    Image|startswith: C:\Program Files\BraveSoftware\
  filter_optional_maxthon:
    Image|contains: \AppData\Local\Maxthon\
    Image|endswith: \maxthon.exe
  filter_optional_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_optional_seamonkey:
    Image|startswith:
      - C:\Program Files\SeaMonkey\
      - C:\Program Files (x86)\SeaMonkey\
    Image|endswith: \seamonkey.exe
  filter_optional_vivaldi:
    Image|contains: \AppData\Local\Vivaldi\
    Image|endswith: \vivaldi.exe
  filter_optional_whale:
    Image|startswith:
      - C:\Program Files\Naver\Naver Whale\
      - C:\Program Files (x86)\Naver\Naver Whale\
    Image|endswith: \whale.exe
  filter_optional_tor:
    Image|contains: \Tor Browser\
  filter_optional_whaterfox:
    Image|startswith:
      - C:\Program Files\Waterfox\
      - C:\Program Files (x86)\Waterfox\
    Image|endswith: \Waterfox.exe
  filter_optional_midori:
    Image|contains: \AppData\Local\Programs\midori-ng\
    Image|endswith: \Midori Next Generation.exe
  filter_optional_slimbrowser:
    Image|startswith:
      - C:\Program Files\SlimBrowser\
      - C:\Program Files (x86)\SlimBrowser\
    Image|endswith: \slimbrowser.exe
  filter_optional_flock:
    Image|contains: \AppData\Local\Flock\
    Image|endswith: \Flock.exe
  filter_optional_phoebe:
    Image|contains: \AppData\Local\Phoebe\
    Image|endswith: \Phoebe.exe
  filter_optional_falkon:
    Image|startswith:
      - C:\Program Files\Falkon\
      - C:\Program Files (x86)\Falkon\
    Image|endswith: \falkon.exe
  filter_optional_avant:
    Image|startswith:
      - C:\Program Files (x86)\Avant Browser\
      - C:\Program Files\Avant Browser\
    Image|endswith: \avant.exe
  condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
  - Likely with other browser software. Apply additional filters for any other browsers you might use.
level: medium
license: DRL-1.1

What it detects

This rule flags Windows DNS queries where the query name ends with domains associated with common remote access and remote support software, or matches a RustDesk DNS pattern. It matters because adversaries can use legitimate remote access tools to blend in while establishing command-and-control or interactive session connectivity. The detection relies on DNS query telemetry (query names) and process image context to exclude traffic generated by common web browsers.

Known false positives

Likely with other browser software. Apply additional filters for any other browsers you might use.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.