Detection of Non-Browser DNS Queries to Remote Access Software Domains

Adversaries often use legitimate desktop support and remote access tools to establish interactive command and control (C2) channels. These tools are frequently whitelisted by application control policies due to their role in technical support operations. By monitoring DNS queries directed at these specific domains from processes other than authorized web browsers, defenders can identify suspicious execution of Remote Monitoring and Management (RMM) or remote access utilities. This telemetry is critical for identifying unauthorized persistence and lateral movement attempts by threat groups, such as Scattered Spider, which have been observed utilizing various RMM solutions to maintain access.

Impact

Successful deployment of unauthorized remote access software allows attackers to perform interactive operations, exfiltrate sensitive data, and bypass traditional security controls that trust signed support tools. This activity is a common precursor to ransomware deployment and large-scale data breaches in enterprise environments.

Recommendation

Deploy the provided Sigma rule to detect DNS queries to RMM domains from non-browser applications.

• Baseline your organization's authorized remote access tools and tune the rule to allowlist sanctioned versions.
• Integrate these findings into your incident response process to verify if the initiated connection was requested by an authorized administrator.
• Review and monitor internal outbound DNS traffic for these specific domains.