huntrule

Windows: TeamViewer Log File Deletion

Alerts on deletion of TeamViewer *.log files on Windows, excluding deletions performed by svchost.exe.

FreeUnreviewedSigmalowv1
title: "Windows: TeamViewer Log File Deletion"
id: a08dc6f5-400c-46a8-b86a-383c81f15234
status: test
description: This rule identifies Windows file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", indicating TeamViewer log files were removed. Deleting application logs can be used to hinder forensic investigation and reduce available evidence on the host. The detection relies on Windows file deletion telemetry containing the target filename, and it excludes cases where the deleting process is svchost.exe.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2023-02-15
tags:
  - attack.stealth
  - attack.t1070.004
logsource:
  product: windows
  category: file_delete
detection:
  selection:
    TargetFilename|contains: \TeamViewer_
    TargetFilename|endswith: .log
  filter:
    Image: C:\Windows\system32\svchost.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: b1decb61-ed83-4339-8e95-53ea51901720
    type: derived

What it detects

This rule identifies Windows file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", indicating TeamViewer log files were removed. Deleting application logs can be used to hinder forensic investigation and reduce available evidence on the host. The detection relies on Windows file deletion telemetry containing the target filename, and it excludes cases where the deleting process is svchost.exe.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.