Windows DNS Queries for TeamViewer Domains Triggered by Non-TeamViewer Image
Alerts when TeamViewer domains are resolved via DNS by a process whose image name does not include "TeamViewer".
- Product
- windows
- Category
- dns_query
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-30
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows DNS queries for specific TeamViewer-related domains (taf.teamviewer.com and udp.ping.teamviewer.com) when the querying process image path does not contain the string "TeamViewer." This matters because attackers may use masqueraded or renamed binaries to blend into normal DNS traffic while still reaching TeamViewer infrastructure. The detection relies on DNS query telemetry (QueryName) and the process image path (Image field) associated with the querying host.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DNS Queries for TeamViewer Domains Triggered by Non-TeamViewer Image
id: aecb75fc-f9fb-4e14-8bae-23a539c783a8
status: test
description: This rule flags Windows DNS queries for specific TeamViewer-related domains (taf.teamviewer.com and udp.ping.teamviewer.com) when the querying process image path does not contain the string "TeamViewer." This matters because attackers may use masqueraded or renamed binaries to blend into normal DNS traffic while still reaching TeamViewer infrastructure. The detection relies on DNS query telemetry (QueryName) and the process image path (Image field) associated with the querying host.
references:
- https://www.teamviewer.com/en-us/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-30
modified: 2023-09-18
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: dns_query
detection:
selection:
QueryName:
- taf.teamviewer.com
- udp.ping.teamviewer.com
filter_main_teamviewer:
Image|contains: TeamViewer
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown binary names of TeamViewer
- Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications
level: medium
license: DRL-1.1
related:
- id: 778ba9a8-45e4-4b80-8e3e-34a419f0b85e
type: derived