approved rmm deployments, one-time support sessions, product migrations, and security testing can trigger this rule. recursive resolvers or dns forwarders can also appear as the client when sensor placement does not preserve the originating endpoint address.

Techniques

T1219

Sample rules

First Time Seen RMM Service Hostname from Network DNS

source: elastic
technicques:
- T1219

Description

Identifies when a source IP first queries a domain associated with commonly abused Remote Monitoring and Management (RMM) software within the seven-day new-terms history window. RMM tools are legitimate administration products, but adversaries frequently install or abuse them for command and control, persistence, and remote execution.

Detection logic

(
  data_stream.dataset:(fortinet_fortigate.log or network_traffic.dns or suricata.eve or zeek.dns)
  or event.dataset:dns
)
  and source.ip:*
  and dns.question.registered_domain:*
  and (
    dns.question.name:(
      *-relay.screenconnect.com or
      *-relay.screenconnect.com. or
      "agent-api.atera.com" or
      "agent-api.atera.com." or
      "agenthb.atera.com" or
      "agenthb.atera.com." or
      "agentreporting.atera.com" or
      "agentreporting.atera.com." or
      "agents.level.io" or
      "agents.level.io." or
      "api.rustdesk.com" or
      "api.rustdesk.com." or
      "assist.zoho.com" or
      "assist.zoho.com." or
      "boot.net.anydesk.com" or
      "boot.net.anydesk.com." or
      "cc.centrastage.net" or
      "cc.centrastage.net." or
      "client.teamviewer.com" or
      "client.teamviewer.com." or
      "control.connectwise.com" or
      "control.connectwise.com." or
      "deploy01.kaseya.com" or
      "deploy01.kaseya.com." or
      "gateway.zohoassist.com" or
      "gateway.zohoassist.com." or
      "geo.netsupportsoftware.com" or
      "geo.netsupportsoftware.com." or
      "ld.aurelius.host" or
      "ld.aurelius.host." or
      "managedsupport.kaseya.net" or
      "managedsupport.kaseya.net." or
      "ps.atera.com" or
      "ps.atera.com." or
      "pubsub.atera.com" or
      "pubsub.atera.com." or
      "rescue-data-center.logmein-gateway.com" or
      "rescue-data-center.logmein-gateway.com." or
      "router15.teamviewer.com" or
      "router15.teamviewer.com." or
      "rs-ny.rustdesk.com" or
      "rs-ny.rustdesk.com." or
      "serv.superopsalpha.com" or
      "serv.superopsalpha.com." or
      "taf.teamviewer.com" or
      "taf.teamviewer.com."
    )
  )