S1 RMM Detection

endpoint.type = "server" event.dns.request in ("server.action1.com","prod.addigy.com","grtmprod.addigy.com","agents.addigy.com","aeroadmin.com","ammyy.com","anydesk.com","api.playanext.com","anyviewer.com","anyviewer.cn","aomeisoftware.com","aomeikeji.com","atera.com","atera-agent-heartbeat","aweray.com","aweray.net","awerayimg.com","awesun.app","barracudamsp.com","license.bomgar.com","bomgarcloud.com","beyondtrustcloud.com","remotedesktop-pa.googleapis.com","myconnectwise.com","connectwise.com","screenconnect.com","itsupport247.net","beanywhere.com","licenseserver.solarwinds.com","swi-rc.com","swi-tc.com","rmm.datto.com","agent.centrastage.net","audit.centrastage.net","monitoring.centrastage.net","agent-notifications.centrastage.net","agent-comms.centrastage.net","update.centrastage.net","realtime.centrastage.net","ts.centrastage.net","nchuser.com","distantdesktop.com","signalserver.xyz","dwservice.net","fleetdeck.io","getscreen.me","getscreen.ru","iperius.com","iperius-r1.com","iperius-r2.com","iperius-r3.com","iperius-r4.com","iperiusremote.de","entersrl.it","islonline.net","kaseya.com","stun.kaseya.com","managedsupport.kaseya.net","kaseya.net","agents.level.io","online.level.io","builds.level.io","downloads.level.io","litemanager.ru","litemanager.com","update-cdn.logmein.com","secure.logmein.com","update.logmein.com","logmeinrescue.com","logmeinrescue.eu","logmeinrescue-enterprise.com","logmeinrescue-enterprise.eu","remotelyanywhere.com","gotoassist.com","logmeininc.com","logme.in","getgo.com","goto.com","goto-rtc.com","gotomypc.com","logmeincdn.http.internapcdn.net","logmein-gateway.com","meshcentral.com","mremoteng.org","rm.mspbackups.com","client.rmm.mspbackups.com","settings.services.mspbackups.com","connect.ra.msp360.com","foris.cloudberrylab.com","remote.management","logicnow.com","logicnow.us","system-monitor.com","systemmonitor.eu.com","systemmonitor.co.uk","systemmonitor.us","n-able.com","solarwindsmsp.com","rmm-host.com","activate.netsupportsoftware.com","geo.netsupportsoftware.com","ninjarmm.com","opti-tune.com","optitune.us","panorama9.com","kessel-ws.parsec.app","kessel-api.parsec.app","builds.parsec.app","builds.parsecgaming.com","public.parsec.app","parsecusercontent.com","stun.parsec.app","stun6.parsec.app","pcvisit.de","cloudflare-pcvisit.com","pdq.com","pdq.tools","pulseway.com","activate.famatech.com","radminte.com","services.vnc.com","update-check.realvnc.com","remotepc.com","rustdesk.com","screenmeet.com","server-eye.de","showmypc.com","rmshelp.me","splashtop.com","splashtop.eu","nanosystems.it","supremocontrol.com","syncromsp.com","servably.com","syncroapi.com","icanhazip.tacticalrmm.io","tacticalrmm.io","teamviewer.com","teamviewer.cn","ultraviewer.com","xmreality.com","assist.zoho.com","assist.zoho.eu","assist.zoho.com.au","assist.zoho.in","assist.zoho.jp","assist.zoho.uk","assistlab.zoho.com","downloads.zohocdn.com","download-accl.zoho.in","zohoassist.com","zohopublic.com","zohopublic.eu","meeting.zoho.com","meeting.zoho.eu","static.zohocdn.com","zohodl.com.cn","zohowebstatic.com","zohostatic.in")