macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches macOS process creation where TeamViewer Desktop is launched with a specific command line while invoked from the TeamViewer_Service process context. Attackers can use TeamViewer for remote access and session establishment, so identifying this startup pattern can help surface unauthorized remote control activity. It relies on process creation telemetry including ParentImage, Image, and CommandLine fields.

Reporting behind it

Related detections9 linkedT1133 — drag to rearrange

SplashTop Network

Suspicious SoftEther VPN Hamcore Config Written to ProgramData (via file_event)

SplashTop Process

AnyDesk Network

OpenCanary RDP New Connection Attempt on Application Logtype 14001

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

FortiGate: Addition of VPN SSL Web Portal via Event Logs

FortiGate SSL VPN Settings Edited

Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line

Pivot detection · T1133 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-execution-teamviewer-session-command-line-via-teamviewer-service-f459ccb4

title: macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line
id: 87c7298f-791a-4730-bea8-880fad86ab3e
related:
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: similar
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: derived
status: test
description: This rule matches macOS process creation where TeamViewer Desktop is launched with a specific command line while invoked from the TeamViewer_Service process context. Attackers can use TeamViewer for remote access and session establishment, so identifying this startup pattern can help surface unauthorized remote control activity. It relies on process creation telemetry including ParentImage, Image, and CommandLine fields.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /TeamViewer_Service
    Image|endswith: /TeamViewer_Desktop
    CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL