huntrule

Windows DNS Queries for TeamViewer Domains Triggered by Non-TeamViewer Image

Alerts when TeamViewer domains are resolved via DNS by a process whose image name does not include "TeamViewer".

FreeReviewedSigma · Medium · v2
Product
windows
Category
dns_query
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-01-30
Updated
2026-07-31
AnalysisDetection
title: Windows DNS Queries for TeamViewer Domains Triggered by Non-TeamViewer Image
id: aecb75fc-f9fb-4e14-8bae-23a539c783a8
status: test
description: This rule flags Windows DNS queries for specific TeamViewer-related domains (taf.teamviewer.com and udp.ping.teamviewer.com) when the querying process image path does not contain the string "TeamViewer." This matters because attackers may use masqueraded or renamed binaries to blend into normal DNS traffic while still reaching TeamViewer infrastructure. The detection relies on DNS query telemetry (QueryName) and the process image path (Image field) associated with the querying host.
references:
  - https://www.teamviewer.com/en-us/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-30
modified: 2023-09-18
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName:
      - taf.teamviewer.com
      - udp.ping.teamviewer.com
  filter_main_teamviewer:
    Image|contains: TeamViewer
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown binary names of TeamViewer
  - Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications
level: medium
license: DRL-1.1
related:
  - id: 778ba9a8-45e4-4b80-8e3e-34a419f0b85e
    type: derived