DNS Query To Remote Access Software Domain From Non-Browser App

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•4•1•86

This rule detects DNS queries to domains associated with legitimate remote access software (e.g., TeamViewer, Go2Assist, LogMeIn, AmmyyAdmin, RustDesk, Quick Assist, Remote Utilities, Tailscale, Twingate, NetSupport Manager) when those queries originate from a non-browser application. Adversaries often leverage these legitimate tools to establish command and control (C2) channels or maintain persistence on compromised systems, as they may be allowed by application control policies. The rule includes extensive filters to exclude common web browsers and other legitimate system processes that might legitimately query these domains, aiming to reduce false positives.