DNS Queries to RMM Domains from Non-Browser Processes

This brief focuses on the abuse of legitimate Remote Monitoring and Management (RMM) software by threat actors. RMM tools are often used for legitimate IT administration but can be leveraged for malicious purposes such as command and control, persistence, and lateral movement within a compromised network. This activity is identified by detecting DNS queries to a list of known RMM service domains originating from processes that are not typical web browsers. This behavior indicates that an RMM client, script, or other non-browser application is attempting to communicate with an RMM service. The detection rule was published on 2026-03-23 by Elastic and aims to surface unauthorized or malicious use of RMM tools within an organization. It is crucial to differentiate between legitimate and malicious RMM usage by analyzing the context of these DNS queries.

Attack Chain

1. An attacker gains initial access to a Windows system through an unknown method.
2. The attacker installs or deploys a legitimate RMM tool or a modified version.
3. The RMM agent is configured to communicate with the attacker’s command and control infrastructure.
4. A non-browser process (e.g., a script or a standalone executable) initiates a DNS query to resolve an RMM domain (e.g., teamviewer.com, anydesk.com).
5. The DNS query is resolved, establishing a network connection between the compromised system and the RMM service or attacker-controlled server.
6. The attacker leverages the RMM tool to execute commands, transfer files, and maintain persistent access to the compromised system.
7. The attacker performs lateral movement to other systems within the network, utilizing the RMM tool for remote administration.
8. The attacker achieves their objective, such as data exfiltration or ransomware deployment, using the established RMM connection.

Impact

Compromise via RMM tools can lead to significant damage, including unauthorized access to sensitive data, disruption of business operations, and potential ransomware attacks. Successful exploitation allows attackers to maintain persistent access and control over affected systems, facilitating lateral movement and further malicious activities. The widespread use of RMM tools in various sectors makes this a broad threat. The impact can range from a single compromised workstation to the complete takeover of an organization’s IT infrastructure.

Recommendation

• Deploy the provided Sigma rule to your SIEM to detect DNS queries to RMM domains from non-browser processes and tune for your environment.
• Review the IOC list of RMM domains and block any unauthorized RMM services at your DNS resolver.
• Investigate any alerts generated by the Sigma rule by examining the process tree and verifying the legitimacy of the process initiating the DNS query.
• Implement application control policies to restrict the execution of unauthorized RMM tools on your endpoints.
• Enable Sysmon DNS event logging to activate the rules above.