This rule detects the first observed DNS query from a source IP to a domain that matches a curated list of Remote Monitoring and Management (RMM) hostnames commonly used for remote administration and potential command-and-control. It evaluates novelty per source IP and per dns.question.registered_domain within a seven-day new-terms window, triggering when a previously unseen pairing is observed. The rule relies on DNS telemetry from multiple sources (Fortinet FortiGate DNS logs, Suricata Eve DNS events, Zeek DNS, Elastic Network Packet Capture DNS, and legacy Packetbeat DNS) to identify new RMM-related lookups. The registered_domain key prevents multiple hostnames under the same domain from generating redundant alerts for the same client, while multiple registered domains may still yield separate alerts if they represent different RMM endpoints. It is important to note that the alert does not prove malicious RMM use; DNS alone lacks process context and the source IP may be a recursive resolver or forwarder depending on sensor placement. Recommended follow-up includes correlating with endpoint telemetry, validating asset ownership, verifying whether the RMM domain is approved, and scanning for related activity (credential usage, persistence, C2-like traffic). False positives can arise from approved deployments, support sessions, migrations, or lab/test environments. Refer to MITRE ATT&CK T1219 (Remote Access Tools) and T1219.002 (Remote Desktop Software) for contextual framing.