Suspicious TeamViewer Remote Session (via file_event)

title: Suspicious TeamViewer Remote Session (via file_event)
id: 35ee8992-8b15-558d-a5b6-f89f285a3b8d
status: stable
description: This rule detects the creation of log files during a TeamViewer remote session
references:
    - https://attack.mitre.org/techniques/T1219/002/
    - https://www.teamviewer.com/en-us/
author: Huntrule Team
date: 2026-03-12
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    product: windows
    category: file_event
detection:
    selection1:
        TargetFilename|endswith:
            - '\TeamViewer\RemotePrinting\tvprint.db'
            - '\TeamViewer\TVNetwork.log'
    selection2:
        TargetFilename|contains|all:
            - '\TeamViewer'
            - '_Logfile.log'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: medium