Suspicious DNS Lookup by Remote Utilities RMM

[rule]
description = """
Identifies suspicious DNS request by Remote Utilities RMM to no default domain names. Adversaries may abuse RMM software
for remote access control.
"""
id = "ff6e6c37-8048-4b94-8c83-bb9919081caf"
license = "Elastic License v2"
name = "Suspicious DNS Lookup by Remote Utilities RMM"
os_list = ["windows"]
reference = ["https://www.remoteutilities.com/"]
version = "1.0.4"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and process.parent.name : ("msiexec.exe", "services.exe") and
  (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
  process.code_signature.subject_name in ("Ter-Osipov Aleksei Vladimirovich", "Ter-Osipov Aleksey Vladimirovich", "Remote Utilities LLC", "Remote Utilities Pty (Cy) Ltd", "IP Ter-Osipov Aleksey Vladimirovich")]
 [dns where dns.question.name : "*.*" and not dns.question.name : ("ocsp.*", "t?.symcb.com", "t?.symcd.com", "ctldl.windowsupdate.com", "*remoteutilities.com")]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.4.0"