TeamViewer Remote Session Startup Command Execution on Linux

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Linux process creation events where TeamViewer Desktop is launched with an IPC port and module arguments as part of a remote session startup. Attackers can use remote access tooling to establish interactive control, so identifying these session-init command lines helps surface remote access activity. Telemetry relies on process execution details, specifically the parent process path ending with TeamViewer_Service, the TeamViewer Desktop binary path, and the exact command-line suffix containing the IPC port and module.

Reporting behind it

Related detections9 linkedT1133 — drag to rearrange

SplashTop Network

Suspicious SoftEther VPN Hamcore Config Written to ProgramData (via file_event)

SplashTop Process

AnyDesk Network

OpenCanary RDP New Connection Attempt on Application Logtype 14001

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

FortiGate: Addition of VPN SSL Web Portal via Event Logs

FortiGate SSL VPN Settings Edited

Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

TeamViewer Remote Session Startup Command Execution on Linux

Pivot detection · T1133 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-teamviewer-remote-session-start-via-teamviewer-desktop-command-line-1f6b8cd4

title: TeamViewer Remote Session Startup Command Execution on Linux
id: d8774abb-7f8a-42a5-af4d-c7dd9d9b0ff8
related:
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: similar
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: derived
status: test
description: This rule matches Linux process creation events where TeamViewer Desktop is launched with an IPC port and module arguments as part of a remote session startup. Attackers can use remote access tooling to establish interactive control, so identifying these session-init command lines helps surface remote access activity. Telemetry relies on process execution details, specifically the parent process path ending with TeamViewer_Service, the TeamViewer Desktop binary path, and the exact command-line suffix containing the IPC port and module.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /TeamViewer_Service
    Image|endswith: /TeamViewer_Desktop
    CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL