title: DNS Queries to Known RMM Domains
id: 9fa68c28-79b2-4ab5-af95-0c7b2f706c63
status: experimental
description: Detects DNS queries to known Remote Monitoring and Management (RMM) tool
  domains that could indicate unauthorized remote access
references:
- https://github.com/magicsword-io/LOLRMM
author: LOLRMM Project
date: '2025-03-18'
modified: '2026-10-05'
tags:
- attack.command-and-control
- attack.t1219
logsource:
  category: dns
  product: any
detection:
  selection:
    query|contains:
    - .*.-dms.zoho.com.cn
    - .*.01com.com
    - .*.247ithelp.com
    - .*.action1.com
    - .*.adobeconnect.com
    - .*.alpemix.com
    - .*.ammyy.com
    - .*.analytics.insight.rapid7.com
    - .*.anysupport.net
    - .*.anyviewer.com
    - .*.aomeisoftware.com
    - .*.api.jumpcloud.com
    - .*.api.netreo.com
    - .*.api.splashtop.com
    - .*.api.splashtop.eu
    - .*.assist.jumpcloud.com
    - .*.auvik.com
    - .*.baramundi.com
    - .*.beamyourscreen.com
    - .*.beanywhere.com
    - .*.beinsync.com
    - .*.beinsync.net
    - .*.beyondtrustcloud.com
    - .*.bluetrait.io
    - .*.bomgarcloud.com
    - .*.cc.centrastage.net
    - .*.cdn.getgo.com
    - .*.cell-1.domotz.com
    - .*.cfargotunnel.com
    - .*.cloud.tanium.com
    - .*.cloudbackup.management
    - .*.cloudberrylab.com
    - .*.cmdm.comodo.com
    - .*.connect.backdrop.cloud
    - .*.connectwise.com
    - .*.content.rview.com
    - .*.crossloop.com
    - .*.dataplicity.com
    - .*.deskroll.com
    - .*.desktop.qq.com
    - .*.desktopstreaming.com
    - .*.devtunnels.ms
    - .*.distantdesktop.com
    - .*.dms.zoho.com
    - .*.dms.zoho.com.eu
    - .*.domotz.co
    - .*.duetdisplay.com
    - .*.dwservice.net
    - .*.endpoint.ingress.rapid7.com
    - .*.ezhelp.co.kr
    - .*.fastsupport.com
    - .*.fastviewer.com
    - .*.fdcollab.com
    - .*.fixme.it
    - .*.fleetdeck.io
    - .*.freshchat.com
    - .*.freshcloud.io
    - .*.freshconnect.io
    - .*.freshdev.io
    - .*.freshservice.com
    - .*.freshworks.com
    - .*.freshworksapi.com
    - .*.gatherplace.com
    - .*.gatherplace.net
    - .*.getgo.com
    - .*.getscreen.me
    - .*.gotoassist.at
    - .*.gotoassist.com
    - .*.gotoassist.me
    - .*.gotohttp.com
    - .*.GoToMyPC.com
    - .*.heartbeatrm.com
    - .*.helpu.co.kr
    - .*.hostedrmm.com
    - .*.idrive.com
    - .*.immy.bot
    - .*.in-freshbots.ai
    - .*.instanthousecall.com
    - .*.instanthousecall.net
    - .*.intelliadmin.com
    - .*.internetid.ru
    - .*.invgate.net
    - .*.iperius-rs.com
    - .*.iperius.com
    - .*.iperiusremote.com
    - .*.islonline.com
    - .*.islonline.net
    - .*.itagent.com
    - .*.itsm-us1.comodo.com
    - .*.itsupport247.net
    - .*.ivanti.com
    - .*.ivanticloud.com
    - .*.jumpdesktop.com
    - .*.jumpto.me
    - .*.kabuto.io
    - .*.kabutoservices.com
    - .*.kace.com
    - .*.kaseya.net
    - .*.khelpdesk.com.br
    - .*.level.io
    - .*.litemanager.com
    - .*.litemanager.ru
    - .*.localxpose.io
    - .*.logicnow.com
    - .*.logmein.com
    - .*.logmein.eu
    - .*.logmeininc.com
    - .*.logmeinrescue.com
    - .*.logmeinrescue.eu
    - .*.lunixar.com
    - .*.managedsupport.kaseya.net
    - .*.manageengine.com
    - .*.mdmsupport.comodo.com
    - .*.mdt.qq.com
    - .*.mikogo.com
    - .*.mikogo4.com
    - .*.miradore.com
    - .*.msp360.com
    - .*.mspbackups.com
    - .*.my.auvik.com
    - .*.myfreshworks.com
    - .*.mygreenpc.com
    - .*.n-able.com
    - .*.nchuser.com
    - .*.net.anydesk.com
    - .*.netbird.io
    - .*.netop.com
    - .*.netsupportmanager.com
    - .*.netviewer.com
    - .*.ngrok-free.app
    - .*.ngrok.app
    - .*.ngrok.com
    - .*.ngrok.dev
    - .*.ngrok.io
    - .*.ngrok.pizza
    - .*.ngrok.pro
    - .*.ninite.com
    - .*.ninja-backup.com
    - .*.ninjaone.com
    - .*.ninjarmm.com
    - .*.ninjarmm.net
    - .*.ntrsupport.com
    - .*.nvaccess.org
    - .*.opti-tune.com
    - .*.optitune.us
    - .*.parallels.com
    - .*.parsec.app
    - .*.pcvisit.de
    - .*.pilixo.com
    - .*.pitunnel.com
    - .*.prd.cdo.system-monitor.com
    - .*.real-time-collaboration.com
    - .*.rel.tunnels.api.visualstudio.com
    - .*.relay.splashtop.com
    - .*.remmon.hu
    - .*.remote.management
    - .*.remotecall.com
    - .*.remotedesktop-pa.googleapis.com
    - .*.remotedesktop.com
    - .*.remotedesktop.google.com
    - .*.remotepc.com
    - .*.rmm.datto.com
    - .*.rmmservice.ca
    - .*.rmmservice.com.au
    - .*.rmmservice.eu
    - .*.rtschannel.com
    - .*.rudesktop.ru
    - .*.rview.com
    - .*.screenconnect.com
    - .*.screenmeet.com
    - .*.scrn.mt
    - .*.search.namequery.com
    - .*.senso.cloud
    - .*.server-eye.de
    - .*.server.absolute.com
    - .*.set.me
    - .*.shellhub.io
    - .*.showmypc.com
    - .*.signalserver.xyz
    - .*.sophos.com
    - .*.sophosupd.com
    - .*.sophosupd.net
    - .*.sorillus.com
    - .*.soti.net
    - .*.splashtop.com
    - .*.spytech-web.com
    - .*.startsupport.com
    - .*.superops.ai
    - .*.superopsalpha.com
    - .*.superopsbeta.com
    - .*.support.services.microsoft.com
    - .*.supremocontrol.com
    - .*.swi-tc.com
    - .*.syncroapi.com
    - .*.syncromsp.com
    - .*.syspectr.com
    - .*.system-monitor.com
    - .*.systemmonitor.co.uk
    - .*.systemmonitor.eu.com
    - .*.systemmonitor.us
    - .*.tailscale.com
    - .*.tailscale.io
    - .*.teamviewer.com
    - .*.techinline.net
    - .*.teknopars.com
    - .*.teleport.sh
    - .*.teramind.co
    - .*.tiflux.com
    - .*.tmate.io
    - .*.todesk.com
    - .*.trycloudflare.com
    - .*.ultraviewer.net
    - .*.vicarius.cloud
    - .*.webpush.freshchat.com
    - .*.weezo.me
    - .*.weezo.net
    - .*.wormhole.dataplicity.com
    - .*.xeox.com
    - .*.zerotier.com
    - .*.zoho.com
    - .*.zoho.com.au
    - .*.zoho.com.cn
    - .*.zoho.eu
    - .*.zoho.in
    - .*.zohoassist.com
    - .*.zohoassist.com.cn
    - .*.zohoassist.jp
    - .136.243.104.235
    - .136.243.104.242
    - .136.243.18.122
    - .160.191.182.41
    - .192.144.34.42
    - .192.3.95.152
    - .198.46.178.135
    - .1wuccjc4a3.execute-api.eu-west-1.amazonaws.com
    - .29qoj3q0yf.execute-api.us-west-2.amazonaws.com
    - .51.255.19.178
    - .51.255.19.179
    - .8z5x4rqbxi.execute-api.eu-west-1.amazonaws.com
    - ._v2-origintunneld._tcp.argotunnel.com
    - .a1-backend-packages.s3.amazonaws.com
    - .a33d8yamkwy4nx-ats.iot.ap-southeast-2.amazonaws.com
    - .a33d8yamkwy4nx-ats.iot.eu-central-1.amazonaws.com
    - .a33d8yamkwy4nx-ats.iot.eu-west-1.amazonaws.com
    - .a33d8yamkwy4nx-ats.iot.us-west-2.amazonaws.com
    - .account.flexihub.com
    - .activation.netreo.net
    - .aeroadmin.com
    - .agent-api.atera.com
    - .agent.tiflux.com
    - .agenthb.atera.com
    - .agentmqtt.fleetdeck.io
    - .agentreporting.atera.com
    - .agentreportingstore.blob.core.windows.net
    - .agents*-cloud.acronis.com
    - .agents.addigy.com
    - .agents.level.io
    - .ammyy.com
    - .anyplace-control.com
    - .api-ca-1.lavawall.com
    - .api.allocentra.co.za
    - .api.cloudflare.com
    - .api.fdcollab.com
    - .api.helpwire.app
    - .api.hoptodesk.com
    - .api.idrive.com
    - .api.localxpose.io
    - .api.monitic.com
    - .api.mremote.io
    - .api.netbird.io
    - .api.remote.it
    - .api.remsupp.com
    - .api.rg-supervision.com
    - .api.rmmmax.com
    - .api.rustdesk.com
    - .apicdn-wchat.freshchat.com
    - .app-af-agent-prod-009.azurewebsites.net
    - .app.atera.com
    - .app.deskday.ai
    - .app.gorelo.io
    - .app.kabuto.io
    - .app.lunixar.com
    - .app.monitic.com
    - .app.netbird.io
    - .app.pdq.com
    - .app.tiflux.com
    - .app.zecurit.com
    - .appcdn.atera.com
    - .asapi*.aweray.net
    - .assist.zoho.com
    - .atera-agent-heartbeat.servicebus.windows.net
    - .atera.pubnubapi.com
    - .atled.syspectr.com
    - .attachments.servably.com
    - .auth*.aeroadmin.com
    - .auth.api.remote.it
    - .auvik.com
    - .barracudamsp.com
    - .basecamp.com
    - .beamyourscreen.com
    - .beanywhere.com
    - .blackcryptknight.com
    - .bluetrait.io
    - .bomgarcloud.com
    - .boot.net.anydesk.com
    - .breeze.app
    - .breezermm.com
    - .builds.level.io
    - .c.mid.al
    - .caremote1.lavawall.com
    - .cc.centrastage.net
    - .cdn.teleport.dev
    - .cell-1.domotz.com
    - .centuriontech.com
    - .cfcdn.pdq.com
    - .cftunnel.com
    - .changes.panorama9.com
    - .charon.netreo.net
    - .checkip.zmazonaws.com
    - .chromoting-client.talkgadget.google.com
    - .chromoting-host.talkgadget.google.com
    - .chromoting-oauth.talkgadget.google.com
    - .client-api.aweray.com
    - .client.oray.net
    - .client.teamviewer.com
    - .cloud-233f9.firebaseapp.com
    - .cloud-ed980.firebaseapp.com
    - .cloud.acronis.com
    - .cloud.faronics.com
    - .cloud.shellhub.io
    - .cloud.tanium.com
    - .cloudbackup.management
    - .comserver.eu1.mspa.n-able.com
    - .comserver.global.mspa.n-able.com
    - .comserver.us1.mspa.n-able.com
    - .comserver.us2.mspa.n-able.com
    - .connect.acronis.com
    - .connect.ap.ngrok-agent.com
    - .connect.au.ngrok-agent.com
    - .connect.eu.ngrok-agent.com
    - .connect.in.ngrok-agent.com
    - .connect.jp.ngrok-agent.com
    - .connect.ngrok-agent.com
    - .connect.sa.ngrok-agent.com
    - .connect.us.ngrok-agent.com
    - .connectwise.com
    - .content.rview.com
    - .control.connectwise.com
    - .crossloop.en.softonic.com
    - .d1m8kha1zyjal6.cloudfront.net
    - .dameware.com
    - .dashboard.rg-supervision.com
    - .dataplicity.com
    - .deepfreeze.com
    - .demo.controlr.app
    - .deploy.faronics.com
    - .deploy01.kaseya.com
    - .deskday.ai
    - .deskroll.com
    - .desktopcentral.manageengine.cn
    - .desktopcentral.manageengine.com
    - .desktopcentral.manageengine.com.eu
    - .devapi.monitic.com
    - .devrmm.lunixar.com
    - .dms.zecurit.com
    - .docs.baramundi.com
    - .docs.faronics.com
    - .docs.invgate.net
    - .docs.tacticalrmm.com
    - .domotz.com
    - .donkz.nl
    - .download.hoptodesk.com
    - .download.pilixo.com
    - .download.remsupp.com
    - .downloads.level.io
    - .downloads.lunixar.com
    - .downloads.vector-networks.com
    - .downloads.zohocdn.com
    - .downloads.zohodl.com.cn
    - .dronemaker.org
    - .duetdisplay.com
    - .eb.ap-southeast-2.prd.davinci.system-monitor.com
    - .eb.eu-central-1.prd.davinci.system-monitor.com
    - .eb.eu-west-1.prd.davinci.system-monitor.com
    - .eb.us-west-2.prd.davinci.system-monitor.com
    - .ehorus.com
    - .electric.ai
    - .emcosoftware.com
    - .encapto.com
    - .ericom.com
    - .eu.2breeze.app
    - .everywhere.laplink.com
    - .ezhelp.co.kr
    - .faronics-deploy-int-production-installers.s3.eu-west-1.amazonaws.com
    - .faronics-deploy-na-production-installers.s3.us-west-2.amazonaws.com
    - .faronics.com
    - .faronicscloud.com
    - .fastviewer.com
    - .feeds.n-able.com
    - .fixme.it
    - .fleetdeck.io
    - .fortra.com
    - .forum.glpi-project.org
    - .freshasset.com
    - .freshservice.com
    - .fstools.freshasset.com
    - .fstools.freshservice.com
    - .gateway.miradore.com
    - .gateway.zohoassist.com
    - .gatherplace.com
    - .gd.bj2.xyz
    - .geo.netsupportsoftware.com
    - .gerwconline.blob.core.windows.net
    - .get.helpwire.app
    - .getalphacontrol.com
    - .GetScreen.me
    - .ghcr.io
    - .github.com
    - .global.rel.tunnels.api.visualstudio.com
    - .glpi-network.com
    - .glpi-project.org
    - .go.getscreen.me
    - .googl-165a0.web.app
    - .googl-6c11f.firebaseapp.com
    - .googl-6c11f.web.app
    - .gorelo-rmm.azurewebsites.net
    - .goto.com
    - .gotohttp.com
    - .goverlan.com
    - .grtmprod.addigy.com
    - .guacamole.apache.org
    - .gw.remotix.com
    - .gw.usw.gorelo.tech
    - .h2.cftunnel.com
    - .heartbeatrm.com
    - .help.invgate.com
    - .helpbeam.software.informer.com
    - .helpme.net
    - .helpu.co.kr
    - .helpwire.app
    - .hoptodesk.com
    - .idrive.com
    - .image.getscreen.me
    - .immy.bot
    - .imperosoftware.com
    - .instance-*-relay.screenconnect.com
    - .instances-info.invgate.com
    - .instances-list.invgate.com
    - .instanthousecall.com
    - .invgate.com
    - .invgate.net
    - .iperiusremote.com
    - .islonline.com
    - .isodownload.baramundi.com
    - .itagent.com
    - .itsupport247.net
    - .ivanti.com
    - .jumpdesktop.com
    - .jumpto.me
    - .kabuto.io
    - .kabutoservices.com
    - .kaseya.com
    - .kickidler.com
    - .komari-document.pages.dev
    - .lavawinupdate.lavawall.com
    - .lb-insight-001.invgate.net
    - .ld.aurelius.host
    - .le.laplink.com
    - .level.io
    - .light-rmm-monitor-20260825.azurewebsites.net
    - .lisa.rg-supervision.com
    - .litemanager.com
    - .live.screenconnect.com
    - .localxpose.io
    - .logicnow.com
    - .login.netbird.io
    - .login.tailscale.com
    - .logmein-gateway.com
    - .logmeinrescue.com
    - .lr.rmm.pod1.usw.gorelo.tech
    - .lunixar.com
    - .mail.metaquest.com
    - .managedsupport.kaseya.net
    - .manageengine.com
    - .mdmsupport.comodo.com
    - .meshcentral.com
    - .metaquest.com
    - .microuptime.com
    - .mikogo.com
    - .miradore.com
    - .monitic.com
    - .mremoteng.org
    - .msp360.com
    - .my-sharepoint-inc.com
    - .my.kickidler.com
    - .my.splashtop.com
    - .my1cloudlive.com
    - .my2cloudlive.com
    - .mygreenpc.com
    - .myivo-server.software.informer.com
    - .mymeetinggoogle.com
    - .n-able.com
    - .naverisk.com
    - .netbird.io
    - .netreo.com
    - .netsupportmanager.com
    - .neturo.uplus.co.kr
    - .netviewer.com
    - .networkservice.cyou
    - .nezha.wiki
    - .nezhahq.github.io
    - .ngrok.com
    - .nightly.glpi-project.org
    - .ninite.com
    - .ninja-backup.com
    - .ninjaone.com
    - .ninjarmm.net
    - .nomachine.com
    - .nv0mddxkh7.execute-api.us-west-2.amazonaws.com
    - .nvaccess.org
    - .objects.githubusercontent.com
    - .ocsinventory-ng.org
    - .one.comodo.com
    - .online.level.io
    - .opsbridge.digital
    - .packagesstore.blob.core.windows.net
    - .pandoramods.top
    - .panorama9.com
    - .parsec.app
    - .parsec.gg
    - .pcvisit.de
    - .pdqinstallers.*.r2.cloudflarestorage.com
    - .pilixo.com
    - .pitunnel.com
    - .pkgs.netbird.io
    - .plus*.site24x7.cn
    - .plus*.site24x7.com
    - .plus*.site24x7.eu
    - .plus*.site24x7.in
    - .plus*.site24x7.net.au
    - .portal.ehorus.com
    - .prod.addigy.com
    - .ps.atera.com
    - .public.rmm.pod1.usw.gorelo.tech
    - .pubsub.atera.com
    - .pulseway.com
    - .px-*.getscreen.me
    - .qq-messenger.en.softonic.com
    - .quic.cftunnel.com
    - .r1.rmm.uw.gorelo.tech
    - .radmin.com
    - .raw.githubusercontent.com
    - .rdp.duetdisplay.com
    - .region1.v2.argotunnel.com
    - .region2.v2.argotunnel.com
    - .relay-*.net.anydesk.com
    - .relay.netbird.io
    - .releases.invgate.com
    - .releases.n-able.com
    - .remmon.hu
    - .remobo.en.softonic.com
    - .remote.it
    - .remote.management
    - .remoteaccess.itarian.com
    - .remotecall.com
    - .remotedesktop-pa.googleapis.com
    - .remotedesktop.google.com
    - .remotepass.com
    - .remotepc.com
    - .remotepro-ap-southeast-1.faronicsdeploy.com
    - .remotepro-ca-central-1.faronics.com
    - .remotepro-eu-west-1.faronicsdeploy.com
    - .remotepro-sa-east-1.faronicsdeploy.com
    - .remotepro-us-east-1.faronics.com
    - .remotepro-us-west-2.faronics.com
    - .remotepulse.io
    - .remoteutilities.com
    - .repairshopr.com
    - .reporting-connect.teleportinfra.sh
    - .rescue-data-cetner.logmein-gateway.com
    - .rescue-list.*.logmein-gateway.com
    - .resources.ninjarmm.com
    - .rism.pages.dev
    - .rmansys.ru
    - .rmm.barracudamsp.com
    - .rmmservice.ca
    - .rmmservice.com.au
    - .rmmservice.eu
    - .rodex.cc
    - .router15.teamviewer.com
    - .royalapps.com
    - .rport.io
    - .rs-ny.rustdesk.com
    - .rt.teramind.co
    - .rudesktop.ru
    - .runsmart.io
    - .rustdesk.com
    - .savaliyapriyal874-code.github.io
    - .search.namequery.com
    - .secure.instanthousecall.com
    - .seetrol.co.kr
    - .senso.cloud
    - .sentry.dev.teramind.co
    - .serv.superopsalpha.com
    - .servably.com
    - .server.absolute.com
    - .servicedesk.itarian.com
    - .services.glpi-network.com
    - .set.me
    - .shellhub.io
    - .showmypc.com
    - .signal.hoptodesk.com
    - .signal.netbird.io
    - .signalserver.xyz
    - .simple-help.com
    - .sis.n-able.com
    - .skyfex.com
    - .socket.lunixar.com
    - .softbymade.top
    - .sorillus.com
    - .soti.net
    - .splashtop.com
    - .spyanywhere.com
    - .sr.rmm.pod1.usw.gorelo.tech
    - .staging.helpwire.app
    - .static.freshdev.io
    - .stun.helpwire.app
    - .stunserver.stunprotocol.org
    - .sunlogin.oray.com
    - .superops.ai
    - .support.faronics.com
    - .swi-rc.cdn-sw.net
    - .syncromsp.com
    - .syspectr.com
    - .system-monitor.com
    - .systemmonitor.co.uk
    - .systemmonitor.eu.com
    - .systemmonitor.us
    - .systemmonitor.us.cdn.cloudflare.net
    - .taf.teamviewer.com
    - .tailscale.com
    - .tele-desk.com
    - .telesupportgroup.com
    - .teramind.co
    - .tiflux.com
    - .tiflux.com.br
    - .tightvnc.com
    - .tmate.io
    - .todesk.com
    - .trust-access.invgate.com
    - .trust.invgate.com
    - .trustconnectsoftware.com
    - .trusted.panorama9.com
    - .turn.hoptodesk.com
    - .turn.monitic.com
    - .ultraviewer.net
    - .ultravnc.com
    - .upd.faronicslabs.com
    - .update.argotunnel.com
    - .update.n-able.com
    - .upload_data.qq.com
    - .us-region1.v2.argotunnel.com
    - .us-region2.v2.argotunnel.com
    - .us.2breeze.app
    - .usage.teleport.dev
    - .vector-networks.com
    - .vicarius-ap-southeast-3-installer.s3.amazonaws.com
    - .vicarius-ap-southeast-3-installer.s3.ap-southeast-3.amazonaws.com
    - .vicarius-ap-southeast-3-patches.s3.amazonaws.com
    - .vicarius-ap-southeast-3-patches.s3.ap-southeast-3.amazonaws.com
    - .vicarius-ap-southeast-3-release.s3.amazonaws.com
    - .vicarius-ap-southeast-3-release.s3.ap-southeast-3.amazonaws.com
    - .vicarius-eu-central-1-installer.s3.amazonaws.com
    - .vicarius-eu-central-1-installer.s3.eu-central-1.amazonaws.com
    - .vicarius-eu-central-1-patches.s3.amazonaws.com
    - .vicarius-eu-central-1-patches.s3.eu-central-1.amazonaws.com
    - .vicarius-eu-central-1-release.s3.amazonaws.com
    - .vicarius-eu-central-1-release.s3.eu-central-1.amazonaws.com
    - .vicarius-installer.s3.amazonaws.com
    - .vicarius-patches.s3.amazonaws.com
    - .vicarius-release.s3.amazonaws.com
    - .vicarius-release.s3.us-east-1.amazonaws.com
    - .vicarius-static-organizationinstallations.vicarius-cdn.com
    - .vizor.cloud
    - .wangwang.taobao.com
    - .web-16fe.app
    - .web.rustdesk.com
    - .webserv.logistical-software.co.uk
    - .weezo.en.softonic.com
    - .weezo.net
    - .www.baramundi.com
    - .www.dataplicity.com
    - .www.deepfreeze.com
    - .www.faronics.com
    - .www.faronicsdeploy.com
    - .www.freshservice.com
    - .www.glpi-project.org
    - .www.hoptodesk.com
    - .www.invgate.com
    - .www.komari.wiki
    - .www.logistical-software.co.uk
    - .www.metaquest.com
    - .www.monitic.com
    - .www.pitunnel.com
    - .www.remotepc.com
    - .www.remotepulse.io
    - .www.rodex.cc
    - .www.shellhub.io
    - .www.teramind.co
    - .www.tiflux.com
    - .www.tiflux.com.br
    - .www.vector-networks.com
    - .www.vizor.cloud
    - .xeox.com
    - .zabbix.com
    - .zerotier.com
  filter:
    query|contains: your-approved-rmm.com
  condition: selection and not filter
falsepositives:
- Legitimate usage of approved remote management tools
level: medium