improve 4d07b1f4-cb00-4470-b9f8-b0191d48ff52 to detect DWservice

[nekopep]

Description of the Idea of the Rule

The rule 4d07b1f4-cb00-4470-b9f8-b0191d48ff52 detects remote access software domain like teamviewer and anydesk.
There is a less known remote access software that is DWservice and that could be usefull to detect.
It provides remote desktop view, terminal access, files access under linux, windows, mac osx.

https://www.dwservice.net/fr/home.html
https://www.dwservice.net/fr/applications.html

Public References / Example Event Log

I suscessfully detected such access adding this domain:

        QueryName|endswith:
            - '.dwservice.net'

Here are some DNS I get from real detections:

//Usage of remote control (typically a node is accessed)
DNS Resolution
Requested domain name    res-node419012.dwservice.net
Query type  AAAA

//Access to the control interface
DNS Resolution
Requested domain name www.dwservice.net
Query type A

[nasbench]

Hey @nekopep thanks for the suggestion. Will look into this and see to add it to the rule to increase its coverage.

[nasbench]

This now should be fixed in nasbench@01d6414. Added a public ref from MS for abuse . Thanks once again for the suggestion @nekopep