Remote Access Tool - Team Viewer Session Started On Windows Host

Title: Remote Access Tool - Team Viewer Session Started On Windows Host
Status: test
Description:Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
References:
  -Internal Research
Author: Josh Nickels, Qi Nan
Date: 2024-03-11
modified:None
Tags:

• -'attack.persistence'
• -'attack.initial-access'
• -'attack.t1133'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image: 'TeamViewer_Desktop.exe'
    ParentImage: 'TeamViewer_Service.exe'
    CommandLine|endswith: 'TeamViewer_Desktop.exe --IPCport 5939 --Module 1'
  condition:selection
Falsepositives:
  -Legitimate usage of TeamViewer
Level: low