Linux TeamViewer Remote Session Start via TeamViewer_Desktop Command Line

Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.

FreeUnreviewedSigmalowv1

linux-teamviewer-remote-session-start-via-teamviewer-desktop-command-line-1f6b8cd4

title: Linux TeamViewer Remote Session Start via TeamViewer_Desktop Command Line
id: d8774abb-7f8a-42a5-af4d-c7dd9d9b0ff8
related:
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: similar
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: derived
status: test
description: This rule matches process creation where TeamViewer_Desktop is launched with a specific IPC port and module arguments, under the TeamViewer_Service parent process. Starting a remote session from a Linux host can enable remote access for interactive control, so correlating these command-line parameters helps identify session initiation events. The detection relies on Linux process creation telemetry capturing ParentImage, Image, and full CommandLine fields.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /TeamViewer_Service
    Image|endswith: /TeamViewer_Desktop
    CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

What it detects

This rule matches process creation where TeamViewer_Desktop is launched with a specific IPC port and module arguments, under the TeamViewer_Service parent process. Starting a remote session from a Linux host can enable remote access for interactive control, so correlating these command-line parameters helps identify session initiation events. The detection relies on Linux process creation telemetry capturing ParentImage, Image, and full CommandLine fields.

Known false positives

Legitimate usage of TeamViewer

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.