Detectionmediumtest
TeamViewer Remote Session
Detects the creation of log files during a TeamViewer remote session
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event
Events for file system activity including creation, modification, and deletion.
Detection Logic
Detection Logic2 selectors
detection:
selection1:
TargetFilename|endswith:
- '\TeamViewer\RemotePrinting\tvprint.db'
- '\TeamViewer\TVNetwork.log'
selection2:
TargetFilename|contains|all:
- '\TeamViewer'
- '_Logfile.log'
condition: 1 of selection*False Positives
Legitimate uses of TeamViewer in an organisation
References
MITRE ATT&CK
Tactics
Other
attack.t1219.002
Rule Metadata
Rule ID
162ab1e4-6874-4564-853c-53ec3ab8be01
Status
test
Level
medium
Type
Detection
Created
Sun Jan 30
Path
rules/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml
Raw Tags
attack.command-and-controlattack.t1219.002