First Time Seen RMM Service Hostname from Network DNS

Last updated 24 days ago on 2026-09-30

Created 24 days ago on 2026-09-30

About

Identifies when a source IP first queries a domain associated with commonly abused Remote Monitoring and Management (RMM) software within the seven-day new-terms history window. RMM tools are legitimate administration products, but adversaries frequently install or abuse them for command and control, persistence, and remote execution.

Tags

Domain: NetworkUse Case: Network Security MonitoringUse Case: Threat DetectionTactic: Command and ControlData Source: Fortinet FortiGateData Source: Network Packet CaptureData Source: Network TrafficData Source: SuricataData Source: ZeekNoise: UnknownRule Type: New TermsThreat: Remote Management Tool AbuseLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Command and Control (TA0011)(external, opens in a new tab or window)

↳ Remote Access Tools (T1219)(external, opens in a new tab or window)

False Positive Examples

Approved RMM deployments, one-time support sessions, product migrations, and security testing can trigger this rule. Recursive resolvers or DNS forwarders can also appear as the client when sensor placement does not preserve the originating endpoint address.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type

New Terms Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

logs-fortinet_fortigate.log-*logs-network_traffic.dns-*logs-suricata.eve-*logs-zeek.dns-*packetbeat-*

Related Integrations

fortinet_fortigate(external, opens in a new tab or window)

network_traffic(external, opens in a new tab or window)

suricata(external, opens in a new tab or window)

zeek(external, opens in a new tab or window)

Query

✄𐘗text code block:
✄𐘗(
  data_stream.dataset:(fortinet_fortigate.log or network_traffic.dns or suricata.eve or zeek.dns)
  or event.dataset:dns
)
  and source.ip:*
  and dns.question.registered_domain:*
  and (
    dns.question.name:(
      *-relay.screenconnect.com or
      *-relay.screenconnect.com. or
      "agent-api.atera.com" or
      "agent-api.atera.com." or
      "agenthb.atera.com" or
      "agenthb.atera.com." or
      "agentreporting.atera.com" or
      "agentreporting.atera.com." or
      "agents.level.io" or
      "agents.level.io." or
      "api.rustdesk.com" or
      "api.rustdesk.com." or
      "assist.zoho.com" or
      "assist.zoho.com." or
      "boot.net.anydesk.com" or
      "boot.net.anydesk.com." or
      "cc.centrastage.net" or
      "cc.centrastage.net." or
      "client.teamviewer.com" or
      "client.teamviewer.com." or
      "control.connectwise.com" or
      "control.connectwise.com." or
      "deploy01.kaseya.com" or
      "deploy01.kaseya.com." or
      "gateway.zohoassist.com" or
      "gateway.zohoassist.com." or
      "geo.netsupportsoftware.com" or
      "geo.netsupportsoftware.com." or
      "ld.aurelius.host" or
      "ld.aurelius.host." or
      "managedsupport.kaseya.net" or
      "managedsupport.kaseya.net." or
      "ps.atera.com" or
      "ps.atera.com." or
      "pubsub.atera.com" or
      "pubsub.atera.com." or
      "rescue-data-center.logmein-gateway.com" or
      "rescue-data-center.logmein-gateway.com." or
      "router15.teamviewer.com" or
      "router15.teamviewer.com." or
      "rs-ny.rustdesk.com" or
      "rs-ny.rustdesk.com." or
      "serv.superopsalpha.com" or
      "serv.superopsalpha.com." or
      "taf.teamviewer.com" or
      "taf.teamviewer.com."
    )
  )

Install detection rules in Elastic Security

Detect First Time Seen RMM Service Hostname from Network DNS in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).