TeamViewer Domain Query By Non-TeamViewer Application
Detects DNS queries to legitimate TeamViewer domains originating from an application that is not identified as TeamViewer. This behavior can indicate an adversary attempting to obfuscate their use of remote access software by renaming the executable or using a different process to initiate the connection.
Sigma
