macOS Process Execution: TeamViewer Session Command Line via TeamViewer Service

Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.

FreeUnreviewedSigmalowv1

macos-process-execution-teamviewer-session-command-line-via-teamviewer-service-f459ccb4

title: "macOS Process Execution: TeamViewer Session Command Line via TeamViewer Service"
id: 87c7298f-791a-4730-bea8-880fad86ab3e
related:
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: similar
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: derived
status: test
description: This rule matches macOS process creation where TeamViewer starts on a host as part of a remote session. It identifies the specific TeamViewer desktop executable launch command line associated with IPC module usage, which can indicate remote access activity initiated by an external host. The detection relies on process creation telemetry, including the parent process path and the full command line executed.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /TeamViewer_Service
    Image|endswith: /TeamViewer_Desktop
    CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

What it detects

This rule matches macOS process creation where TeamViewer starts on a host as part of a remote session. It identifies the specific TeamViewer desktop executable launch command line associated with IPC module usage, which can indicate remote access activity initiated by an external host. The detection relies on process creation telemetry, including the parent process path and the full command line executed.

Known false positives

Legitimate usage of TeamViewer

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.