TeamViewer Remote Session Startup Command Execution on Linux

Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.

FreeReviewedSigma · Low · v2

Product: linux
Category: process_creation
Author: Josh Nickels, Qi Nan (SigmaHQ), DRL 1.1
Published: 2024-03-11
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Linux process creation events where TeamViewer Desktop is launched with an IPC port and module arguments as part of a remote session startup. Attackers can use remote access tooling to establish interactive control, so identifying these session-init command lines helps surface remote access activity. Telemetry relies on process execution details, specifically the parent process path ending with TeamViewer_Service, the TeamViewer Desktop binary path, and the exact command-line suffix containing the IPC port and module.

Reporting behind it

Related detections9 linkedT1133 — drag to rearrange

Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible PAN-OS CVE-2026-0257 Exploitation via GlobalProtect PoC Artifacts (via network)

Possible RD Web Access Brute Force via Repeated Login POST Requests

Suspicious Security Group Ingress Rule Opened to the Internet via CloudTrail

SplashTop Network

Suspicious SoftEther VPN Hamcore Config Written to ProgramData (via file_event)

SplashTop Process

AnyDesk Network

TeamViewer Remote Session Startup Command Execution on Linux

Pivot detection · T1133 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-teamviewer-remote-session-start-via-teamviewer-desktop-command-line-1f6b8cd4

title: TeamViewer Remote Session Startup Command Execution on Linux
id: d8774abb-7f8a-42a5-af4d-c7dd9d9b0ff8
related:
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: similar
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: derived
status: test
description: This rule matches Linux process creation events where TeamViewer Desktop is launched with an IPC port and module arguments as part of a remote session startup. Attackers can use remote access tooling to establish interactive control, so identifying these session-init command lines helps surface remote access activity. Telemetry relies on process execution details, specifically the parent process path ending with TeamViewer_Service, the TeamViewer Desktop binary path, and the exact command-line suffix containing the IPC port and module.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /TeamViewer_Service
    Image|endswith: /TeamViewer_Desktop
    CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL