huntrule

Windows File Creation of TeamViewer_Desktop.exe During Installation

Alerts on Windows when TeamViewer_Desktop.exe is created, indicating potential installation or dropped remote-access binaries.

FreeUnreviewedSigmamediumv1
title: Windows File Creation of TeamViewer_Desktop.exe During Installation
id: 53fac4e3-8a1b-4d73-bfbd-a89dd2c89f16
status: test
description: This rule flags the creation of TeamViewer_Desktop.exe on Windows, where the filename ends with \TeamViewer_Desktop.exe. Attackers may drop or install remote-access tooling under legitimate-looking software names, making file creation telemetry an important early indicator. Detection relies on Windows file event logs that capture target filename changes during installation.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml
author: frack113, Huntrule Team
date: 2022-01-28
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: \TeamViewer_Desktop.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9711de76-5d4f-4c50-a94f-21e4e8f8384d
    type: derived

What it detects

This rule flags the creation of TeamViewer_Desktop.exe on Windows, where the filename ends with \TeamViewer_Desktop.exe. Attackers may drop or install remote-access tooling under legitimate-looking software names, making file creation telemetry an important early indicator. Detection relies on Windows file event logs that capture target filename changes during installation.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.