macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line

Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.

FreeReviewedSigma · Low · v2

Product: macos
Category: process_creation
Author: Josh Nickels, Qi Nan (SigmaHQ), DRL 1.1
Published: 2024-03-11
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches macOS process creation where TeamViewer Desktop is launched with a specific command line while invoked from the TeamViewer_Service process context. Attackers can use TeamViewer for remote access and session establishment, so identifying this startup pattern can help surface unauthorized remote control activity. It relies on process creation telemetry including ParentImage, Image, and CommandLine fields.

Reporting behind it

Related detections9 linkedT1133 — drag to rearrange

Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible PAN-OS CVE-2026-0257 Exploitation via GlobalProtect PoC Artifacts (via network)

Possible RD Web Access Brute Force via Repeated Login POST Requests

Suspicious Security Group Ingress Rule Opened to the Internet via CloudTrail

SplashTop Network

Suspicious SoftEther VPN Hamcore Config Written to ProgramData (via file_event)

SplashTop Process

AnyDesk Network

macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line

Pivot detection · T1133 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-execution-teamviewer-session-command-line-via-teamviewer-service-f459ccb4

title: macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
id: 87c7298f-791a-4730-bea8-880fad86ab3e
related:
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: similar
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: derived
status: test
description: This rule matches macOS process creation where TeamViewer Desktop is launched with a specific command line while invoked from the TeamViewer_Service process context. Attackers can use TeamViewer for remote access and session establishment, so identifying this startup pattern can help surface unauthorized remote control activity. It relies on process creation telemetry including ParentImage, Image, and CommandLine fields.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /TeamViewer_Service
    Image|endswith: /TeamViewer_Desktop
    CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL