Windows DNS: TeamViewer domain queried by non-TeamViewer-named process

Alerts when TeamViewer domains are resolved via DNS by a process whose image name does not include "TeamViewer".

FreeUnreviewedSigmamediumv1

windows-dns-teamviewer-domain-queried-by-non-teamviewer-named-process-778ba9a8

title: "Windows DNS: TeamViewer domain queried by non-TeamViewer-named process"
id: aecb75fc-f9fb-4e14-8bae-23a539c783a8
status: test
description: This rule flags DNS queries for specific TeamViewer-related domains (taf.teamviewer.com and udp.ping.teamviewer.com) when the querying process image does not contain the string "TeamViewer". Attackers may use alternate or renamed binaries to blend in while still contacting TeamViewer for command-and-control. The detection relies on Windows DNS query telemetry and process image name data to identify mismatches between the queried domain and the expected TeamViewer client naming.
references:
  - https://www.teamviewer.com/en-us/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-30
modified: 2023-09-18
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName:
      - taf.teamviewer.com
      - udp.ping.teamviewer.com
  filter_main_teamviewer:
    Image|contains: TeamViewer
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown binary names of TeamViewer
  - Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications
level: medium
license: DRL-1.1
related:
  - id: 778ba9a8-45e4-4b80-8e3e-34a419f0b85e
    type: derived

What it detects

This rule flags DNS queries for specific TeamViewer-related domains (taf.teamviewer.com and udp.ping.teamviewer.com) when the querying process image does not contain the string "TeamViewer". Attackers may use alternate or renamed binaries to blend in while still contacting TeamViewer for command-and-control. The detection relies on Windows DNS query telemetry and process image name data to identify mismatches between the queried domain and the expected TeamViewer client naming.

Known false positives

Unknown binary names of TeamViewer
Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.