Suspicious DNS Queries to Remote Monitoring and Management Domains from Non-Browser Processes

hello@craftedsignal.io — Mon, 06 Jul 2026 14:01:27 +0000

This threat brief focuses on the detection of suspicious DNS queries directed towards domains associated with Remote Monitoring and Management (RMM) and remote access software. Threat actors frequently exploit legitimate RMM tools for various malicious purposes, including establishing command and control (C2), maintaining persistence within compromised environments, and facilitating lateral movement. The detection rule specifically targets DNS queries made by non-browser processes, aiming to surface activity from unapproved RMM clients, malicious scripts, or other unexpected software attempting to contact these services. This approach helps defenders identify unauthorized remote access, which could indicate a compromise, or the illicit use of legitimate tools for adversary operations, enabling timely response and mitigation.

Attack Chain

Initial Access: A user falls victim to a phishing email or exploits an internet-facing vulnerability, allowing an attacker to gain an initial foothold on a system.
Execution & Staging: Malicious code is executed, often disguised as a legitimate application or utility, which may download further tools or scripts.
RMM Tool Deployment: The attacker deploys a legitimate, but often unauthorized or cracked, RMM or remote access client on the compromised system. This could be done through direct installation or by leveraging existing system capabilities.
Command and Control (C2) Initialization: The newly deployed RMM client attempts to establish a connection to its control server, which involves performing DNS queries to its service domains (e.g., teamviewer.com, anydesk.com, connectwise.com).
Persistent Remote Access: Successful connection to the RMM domain provides the attacker with persistent remote access to the compromised system, often bypassing traditional firewall rules due to the nature of RMM applications.
Internal Reconnaissance & Lateral Movement: Using the RMM tool, the attacker conducts internal reconnaissance, maps the network, and moves laterally to other systems within the environment.
Objective Achievement: The attacker executes their final objectives, which may include data exfiltration, deployment of ransomware, or further propagation of malware.

Impact

The abuse of RMM tools by threat actors can lead to severe organizational impact. Successful exploitation can result in unauthorized, persistent access to critical systems, enabling extensive data exfiltration of sensitive information, deployment of ransomware causing significant operational disruption and financial losses, or complete network compromise. Organizations across all sectors, particularly those relying on legitimate RMM for IT support, are susceptible. If the attack succeeds, it can undermine an organization's security posture, lead to regulatory non-compliance, and damage reputation.

Recommendation

Deploy the provided Sigma rule (or its ESQL equivalent) to your SIEM/endpoint security platform and tune for your environment to detect suspicious DNS queries.
Ensure that DNS query logging is enabled for all Windows endpoints, ideally via Sysmon Event ID 22 or Elastic Defend, to provide the necessary telemetry for the detection rule.
Investigate all alerts generated by the Detect DNS Query to Remote Monitoring/Management (RMM) Domain from Non-Browser Process rule, focusing on the process.executable and its parent process.
Review the code signatures (process.code_signature) of flagged processes to verify legitimacy and prevent abuse of trojanized RMM installers.
Block the RMM domains listed in the IOC table at the DNS resolver and firewall levels for any systems not explicitly authorized to use such tools.
Implement and enforce a strict policy for approved RMM tools and publishers, ensuring only authorized staff use managed, legitimate software for remote support.

First Time Seen Remote Monitoring and Management Tool Detection

hello@craftedsignal.io — Fri, 03 Jul 2026 15:36:36 +0000

Adversaries frequently exploit the trusted nature and broad capabilities of legitimate Remote Monitoring and Management (RMM) and remote access software to maintain covert access and control over compromised Windows systems. This threat brief focuses on the detection of these tools when they are observed for the first time on a given endpoint, indicating potential unauthorized deployment. While these tools are essential for IT administration, their abuse facilitates command-and-control (C2), enables persistence, and allows for the execution of arbitrary commands. Notable campaigns, such as those leading to domain-wide ransomware (as highlighted by The DFIR Report), often involve the misuse of RMM solutions like SimpleHelp, AnyDesk, and ConnectWise Control. This detection method identifies suspicious installations by monitoring process names and code signatures for commonly abused RMM tools, specifically triggering when a host.id and process.name pair has not been seen within a defined 7-day historical window.

Attack Chain

Initial Access: Adversaries gain initial access to an organization's network, often through methods such as phishing, exploiting vulnerable public-facing applications, or supply chain compromises.
Execution: After establishing a foothold, the adversary deploys a legitimate RMM agent or client onto the compromised Windows host. This deployment may occur via various methods, including malicious ISO files (as referenced in a DFIR report) or existing remote access.
Persistence: The installed RMM tool is configured by the adversary to ensure continued access to the compromised system, often by establishing itself as a service or through other autorun mechanisms.
Command and Control: The RMM agent initiates an outbound connection to an adversary-controlled server, establishing a stable and often encrypted C2 channel that blends with legitimate network traffic.
Execution via RMM: The adversary leverages the RMM tool's remote execution capabilities to deploy additional malware, execute commands, exfiltrate data, or initiate further lateral movement within the network.
Impact: The adversary achieves their final objective, which can range from data exfiltration and espionage to the deployment of ransomware, encrypting critical organizational data.

Impact

The abuse of RMM tools by adversaries can lead to severe organizational impact. When compromised, RMM tools provide a high level of control over the affected endpoints, enabling attackers to bypass traditional security controls due to the legitimate nature of the software. This can result in widespread data exfiltration, system damage through unauthorized software installations or configurations, and ultimately, significant financial losses due to ransomware deployment and business disruption. CISA has issued advisories highlighting the use of RMM tools in ransomware campaigns, underscoring the critical risk these compromises pose to organizations across all sectors.

Recommendation

Deploy the provided Sigma rule "First Time Seen Remote Monitoring and Management Tool (Windows)" to your SIEM and tune it for your environment.
Ensure Sysmon process creation and code signing event logging is enabled across all Windows endpoints to provide the necessary telemetry for the detection rule.
Investigate all alerts generated by this rule immediately, focusing on the process.executable, process.command_line, and process.code_signature.subject_name fields.
Review network logs for suspicious outbound connections from newly observed RMM processes.
Establish clear organizational policies for RMM tool deployment and usage, including strict change management processes and whitelisting of authorized RMM executables and signers.

LogMeIn Rescue - CraftedSignal Threat Feed

Suspicious DNS Queries to Remote Monitoring and Management Domains from Non-Browser Processes

Attack Chain

Impact

Recommendation

First Time Seen Remote Monitoring and Management Tool Detection

Attack Chain

Impact

Recommendation