TeamViewer Remote Session

Title: TeamViewer Remote Session
Status: test
Description:Detects the creation of log files during a TeamViewer remote session
References:
  -https://www.teamviewer.com/en-us/
Author: Florian Roth (Nextron Systems)
Date: 2022-01-30
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1219.002'

Logsource:

• product: windows
• category: file_event

Detection:
  selection1:
    TargetFilename|endswith:
      -'\TeamViewer\RemotePrinting\tvprint.db'
      -'\TeamViewer\TVNetwork.log'

  selection2:
    TargetFilename|contains|all:
      -'\TeamViewer'
      -'_Logfile.log'

  condition:1 of selection*
Falsepositives:
  -Legitimate uses of TeamViewer in an organisation
Level: medium