Windows File Creation of TeamViewer_Desktop.exe During Install
Alerts on Windows when TeamViewer_Desktop.exe is created, indicating potential installation or dropped remote-access binaries.
- Product
- windows
- Category
- file_event
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-28
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies creation of the TeamViewer_Desktop.exe file on Windows by matching file creation events where the target filename ends with \TeamViewer_Desktop.exe. Attackers may install remote access or support tooling to enable command-and-control or remote interaction. The detection relies on Windows file creation telemetry that records the target file path and name.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Creation of TeamViewer_Desktop.exe During Install
id: 53fac4e3-8a1b-4d73-bfbd-a89dd2c89f16
status: test
description: This rule identifies creation of the TeamViewer_Desktop.exe file on Windows by matching file creation events where the target filename ends with \TeamViewer_Desktop.exe. Attackers may install remote access or support tooling to enable command-and-control or remote interaction. The detection relies on Windows file creation telemetry that records the target file path and name.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml
author: frack113, Huntrule Team
date: 2022-01-28
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: \TeamViewer_Desktop.exe
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9711de76-5d4f-4c50-a94f-21e4e8f8384d
type: derived