Windows DNS Queries to Remote Support and Remote Access Domains From Non-Browser Processes

Alert on DNS lookups for remote access service domains from non-browser executables, including RustDesk subdomains.

FreeReviewedSigma · Medium · v2

Product: windows
Category: dns_query
Author: frack113, Connor Martin (SigmaHQ), DRL 1.1
Published: 2022-07-11
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1219Remote Access Tools
- T1219.002Remote Desktop Software
Exfiltration
Impact

What it detects

This rule flags Windows DNS query events where the queried domain name ends with (or for RustDesk, matches) a set of known remote support and remote access service domains. It matters because attackers may abuse legitimate remote access tooling to establish interactive command-and-control connectivity to targets. The detection relies on DNS query telemetry including QueryName and process Image, with optional exclusions to reduce noise from common browser-generated queries.

Reporting behind it

Related detections9 linkedT1219 — drag to rearrange

Possible AnyDesk RMM Silent MSI Installation via Windows Installer (via process_creation)

macOS Process Creation: MeshAgent Remote Access via --meshServiceName

Windows MeshAgent Remote Access Tool Command Line Execution Indicators

Windows Process Creation: Microsoft QuickAssist.exe Execution

Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes

Windows Incoming AnyDesk Connection via AnyDesk.exe or AnyDeskMSI.exe

Windows File Drop Indicators for RemoteKrbRelay SMB Relay Secret Dump Module

Windows DNS Queries to azurewebsites.net From Non-Browser Processes

Windows CSharp Streamer RAT Potentially Loaded .NET Executable from Temp dat####.tmp

Windows DNS Queries to Remote Support and Remote Access Domains From Non-Browser Processes

Pivot detection · T1219 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dns-queries-to-remote-access-remote-support-domains-from-non-browser-pro-4d07b1f4

title: Windows DNS Queries to Remote Support and Remote Access Domains From Non-Browser Processes
id: e7c50755-7be6-48f1-be90-b4434f7a60b8
related:
  - id: 71ba22cb-8a01-42e2-a6dd-5bf9b547498f
    type: obsolete
  - id: 7c4cf8e0-1362-48b2-a512-b606d2065d7d
    type: obsolete
  - id: ed785237-70fa-46f3-83b6-d264d1dc6eb4
    type: obsolete
  - id: 4d07b1f4-cb00-4470-b9f8-b0191d48ff52
    type: derived
status: test
description: This rule flags Windows DNS query events where the queried domain name ends with (or for RustDesk, matches) a set of known remote support and remote access service domains. It matters because attackers may abuse legitimate remote access tooling to establish interactive command-and-control connectivity to targets. The detection relies on DNS query telemetry including QueryName and process Image, with optional exclusions to reduce noise from common browser-generated queries.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-6---ammyy-admin-software-execution
  - https://redcanary.com/blog/misbehaving-rats/
  - https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
  - https://blog.sekoia.io/scattered-spider-laying-new-eggs/
  - https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist#disable-quick-assist-within-your-organization
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml
author: frack113, Connor Martin, Huntrule Team
date: 2022-07-11
modified: 2024-12-17
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: dns_query
detection:
  selection_generic:
    QueryName|endswith:
      - agent.jumpcloud.com
      - agentreporting.atera.com
      - ammyy.com
      - api.parsec.app
      - api.playanext.com
      - api.splashtop.com
      - app.atera.com
      - assist.zoho.com
      - authentication.logmeininc.com
      - beyondtrustcloud.com
      - cdn.kaseya.net
      - client.teamviewer.com
      - comserver.corporate.beanywhere.com
      - control.connectwise.com
      - downloads.zohocdn.com
      - dwservice.net
      - express.gotoassist.com
      - getgo.com
      - getscreen.me
      - integratedchat.teamviewer.com
      - join.zoho.com
      - kickstart.jumpcloud.com
      - license.bomgar.com
      - logmein-gateway.com
      - logmein.com
      - logmeincdn.http.internapcdn.net
      - n-able.com
      - net.anydesk.com
      - netsupportsoftware.com
      - parsecusercontent.com
      - pubsub.atera.com
      - relay.kaseya.net
      - relay.screenconnect.com
      - relay.splashtop.com
      - remoteassistance.support.services.microsoft.com
      - remotedesktop-pa.googleapis.com
      - remoteutilities.com
      - secure.logmeinrescue.com
      - services.vnc.com
      - static.remotepc.com
      - swi-rc.com
      - swi-tc.com
      - tailscale.com
      - telemetry.servers.qetqo.com
      - tmate.io
      - twingate.com
      - zohoassist.com
  selection_rustdesk:
    QueryName|endswith: .rustdesk.com
    QueryName|startswith: rs-
  filter_optional_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_safari:
    Image|endswith: \safari.exe
  filter_optional_defender:
    Image|endswith:
      - \MsMpEng.exe
      - \MsSense.exe
  filter_optional_brave:
    Image|endswith: \brave.exe
    Image|startswith: C:\Program Files\BraveSoftware\
  filter_optional_maxthon:
    Image|contains: \AppData\Local\Maxthon\
    Image|endswith: \maxthon.exe
  filter_optional_opera:
    Image|contains: \AppData\Local\Programs\Opera\
    Image|endswith: \opera.exe
  filter_optional_seamonkey:
    Image|startswith:
      - C:\Program Files\SeaMonkey\
      - C:\Program Files (x86)\SeaMonkey\
    Image|endswith: \seamonkey.exe
  filter_optional_vivaldi:
    Image|contains: \AppData\Local\Vivaldi\
    Image|endswith: \vivaldi.exe
  filter_optional_whale:
    Image|startswith:
      - C:\Program Files\Naver\Naver Whale\
      - C:\Program Files (x86)\Naver\Naver Whale\
    Image|endswith: \whale.exe
  filter_optional_tor:
    Image|contains: \Tor Browser\
  filter_optional_whaterfox:
    Image|startswith:
      - C:\Program Files\Waterfox\
      - C:\Program Files (x86)\Waterfox\
    Image|endswith: \Waterfox.exe
  filter_optional_midori:
    Image|contains: \AppData\Local\Programs\midori-ng\
    Image|endswith: \Midori Next Generation.exe
  filter_optional_slimbrowser:
    Image|startswith:
      - C:\Program Files\SlimBrowser\
      - C:\Program Files (x86)\SlimBrowser\
    Image|endswith: \slimbrowser.exe
  filter_optional_flock:
    Image|contains: \AppData\Local\Flock\
    Image|endswith: \Flock.exe
  filter_optional_phoebe:
    Image|contains: \AppData\Local\Phoebe\
    Image|endswith: \Phoebe.exe
  filter_optional_falkon:
    Image|startswith:
      - C:\Program Files\Falkon\
      - C:\Program Files (x86)\Falkon\
    Image|endswith: \falkon.exe
  filter_optional_avant:
    Image|startswith:
      - C:\Program Files (x86)\Avant Browser\
      - C:\Program Files\Avant Browser\
    Image|endswith: \avant.exe
  condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
  - Likely with other browser software. Apply additional filters for any other browsers you might use.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL