[Rule Tuning] First Time Seen DNS Query to RMM Domain

[w0rk3r]

Issues

Part of https://github.com/elastic/ia-trade-team/issues/896

Summary

Expand the domain list based of lolrmm.io (Excluded about 30 domains which seemed too generic and would cause FPs)

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ First Time Seen DNS Query to RMM Domain (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[github-actions]

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

• Detailed description of the suggested changes.
• Provide example JSON data or screenshots.
• Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
• Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
• Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
• Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
• Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
• Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
• Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
• Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
• Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
• Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

• updated_date matches the date of tuning PR merged.
• min_stack_version should support the widest stack versions.
• name and description should be descriptive and not include typos.
• query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

• Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
• Ensure that the tuned rule has a low false positive rate.

[Copilot]

Pull request overview

This PR tunes the existing Windows ES|QL rule “First Time Seen DNS Query to RMM Domain” by expanding the known RMM parent-domain allowlist/lookup list (sourced from lolrmm.io) to improve coverage for non-browser DNS lookups to RMM infrastructure.

Changes:

• Updated the rule updated_date to 2026/07/02.
• Added https://lolrmm.io/ to rule references.
• Expanded the parent_domain IN (...) RMM domain list used by the ES|QL query.

[Samirbous]

Excluded about 30 domains which seemed too generic and would cause FP
@w0rk3r can you list which domains were completely removed?

[w0rk3r]

@Samirbous

// --- Excluded Parent Domains ---

// Generic CDN / cloud infrastructure (shared hosting, would match all enterprise traffic)
// "google.com",         // Chrome Remote Desktop — shared with all Google services
// "googleapis.com",     // Chrome Remote Desktop — shared with all Google APIs
// "microsoft.com",      // Microsoft Quick Assist — shared with all Microsoft services
// "apache.org",         // Guacamole — shared with all Apache projects
// "cloudflare.net",     // N-Able — shared Cloudflare CDN
// "cloudflarestorage.com", // PDQ Connect — shared Cloudflare storage
// "windows.net",        // Miradore — shared Azure blob storage
// "softonic.com",       // CrossLoop, QQ, Remobo, Weezo — software download portal
// "basecamp.com",       // Basecamp — project management SaaS
// "visualstudio.com",   // Visual Studio Dev Tunnel — shared with all VS services
// "devtunnels.ms",      // Visual Studio Dev Tunnel — Microsoft dev infra
// "qq.com",             // QQ IM-remote assistance — massive Chinese social platform
// "taobao.com",         // AliWangWang — massive Chinese e-commerce platform
// "zmazonaws.com",      // FleetDeck.io — likely typo for amazonaws.com in lolrmm

// Security / EDR vendors (legitimate security agents, constant enterprise traffic)
// "sophos.com",         // Sophos Remote Management System
// "sophosupd.com",      // Sophos update infrastructure
// "sophosupd.net",      // Sophos update infrastructure
// "rapid7.com",         // Rapid7 agent/console
// "tanium.com",         // Tanium endpoint management
// "comodo.com",         // Comodo RMM / Itarian — also massive CA/security vendor
// "fortra.com",         // Fortra (GoAnywhere, Cobalt Strike parent) — security vendor

// Enterprise IT management (widely deployed, not RMM abuse signal)
// "ivanti.com",         // LANDesk / Ivanti — enterprise UEM
// "ivanticloud.com",    // Ivanti Remote Control / LANDesk cloud
// "kace.com",           // Quest KACE — enterprise patching/UEM
// "pdq.com",            // PDQ Connect/Deploy — enterprise software deployment
// "manageengine.com",   // ManageEngine Desktop Central — broad IT management suite
// "manageengine.cn",    // ManageEngine China region
// "soti.net",           // SOTI MobiControl — enterprise MDM/EMM

// Monitoring / observability (not endpoint RMM)
// "zabbix.com",         // Zabbix Agent — infrastructure monitoring
// "site24x7.com",       // Site24x7 — SaaS monitoring/observability
// "site24x7.cn",        // Site24x7 China
// "site24x7.eu",        // Site24x7 EU
// "site24x7.in",        // Site24x7 India
// "netreo.com",         // Netreo — network/infrastructure monitoring
// "netreo.net",         // Netreo alternate domain
// "domotz.co",          // Domotz — network monitoring, not endpoint RMM
// "domotz.com",         // Domotz corporate domain

// Backup / virtualization (not remote access)
// "acronis.com",        // Acronis Cyber Protect (Remotix) — backup vendor
// "idrive.com",         // iDrive — backup service
// "parallels.com",      // Parallels Access — virtualization platform
// "cloudbackup.management", // N-Able Cove/MOB backup agent
// "cloudberrylab.com",  // MSP360 (CloudBerry) — backup product
// "mspbackups.com",     // MSP360 backup-specific domain

// Tunneling
// "ngrok.com",          // ngrok — developer tunneling tool
// "ngrok-agent.com",    // ngrok agent control plane
// "tailscale.io",       // Tailscale — VPN/mesh networking
// "zerotier.com",       // ZeroTier — virtual SDN/mesh networking

// Too broad / multi-product (parent domain serves non-RMM products)
// "goto.com",           // GoTo umbrella — Meeting, Webinar, Training, not just RMM
// "zoho.com",           // Zoho — entire SaaS suite (CRM, Mail, Docs, Books)
// "zoho.in",            // Zoho India region — same multi-product issue
// "zohocdn.com",        // Zoho CDN — serves ALL Zoho products
// "iperius.com",        // Iperius — mixed with Iperius Backup product

// OEM persistence / anti-theft (pre-installed on enterprise laptops)
// "absolute.com",       // Absolute (Computrace) — OEM endpoint persistence
// "namequery.com",      // Absolute agent persistence mechanism

// Non-RMM / wrong category
// "adobeconnect.com",   // Adobe Connect — conferencing platform
// "nvaccess.org",       // NVDA — screen reader accessibility tool
// "ocsinventory-ng.org", // OCS Inventory — inventory/asset tool
// "mremoteng.org",      // mRemoteNG — connection manager (no agent)
// "duetdisplay.com",    // Duet Display — display extension tool
// "itagent.com",        // Duet Display agent domain
// "informer.com",       // HelpBeam/MyIVO — generic domain
// "senso.cloud",        // Senso.cloud — education classroom monitoring
// "encapto.com",        // Encapto — MSP network orchestration
// "runsmart.io",        // RunSmart — DCIM/datacenter monitoring
// "remotepass.com",     // RemotePass — HR/payroll platform (not RMM anymore)

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ First Time Seen DNS Query to RMM Domain (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ First Time Seen DNS Query to RMM Domain (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[Samirbous]

@w0rk3r

none of the 65 excluded parent domains appear in the query's WHERE parent_domain IN (...) list, so they'll never trigger the rule. The two lists are deliberately disjoint.
Worth flagging a few near-misses in case they're typos/oversights rather than intentional:

tailscale.io (excluded) vs tailscale.com (included) — different TLD, so the exclusion comment doesn't actually suppress Tailscale traffic on .com, and the query would still alert on tailscale.com lookups.
zoho.com (excluded, "too broad") vs zoho.eu (included) — same product family, split logic across two regions.
iperius.com (excluded, "mixed with backup product") vs iperius.net / iperiusremote.com (included) — again same vendor family, different domains.
goto.com (excluded, "too broad") vs gotoassist.com, getgo.com, gotoresolve.com (included) — consistent with the exclusion note, just confirming there's no overlap.

If the intent behind excluding tailscale.io was to suppress Tailscale noise generally, you may want to also exclude tailscale.com from the include list (or vice versa, decide if tailscale.com traffic is meaningful RMM-abuse signal you want to keep).

[w0rk3r]

Clarified with Samir that this is expanding the domain list, and the exclusion refers to the lolrmm dataset and not the existing query. g2g

[tradebot-elastic]

⛔️ Test failed

Results

• ❌ First Time Seen DNS Query to RMM Domain (esql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta