Windows: TeamViewer remote session log file creation (vprint.db and TVNetwork.log)

title: "Windows: TeamViewer remote session log file creation (vprint.db and TVNetwork.log)"
id: b48ff7af-4028-43ed-a5cd-402dda782277
status: test
description: This rule identifies the creation of specific TeamViewer log database and log files on Windows during remote sessions. Attackers can use remote access tools to establish control while leaving forensic artifacts such as TeamViewer-generated files. The detection relies on Windows file event telemetry that records TargetFilename values matching the expected TeamViewer paths and log filenames.
references:
  - https://www.teamviewer.com/en-us/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-30
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: file_event
detection:
  selection1:
    TargetFilename|endswith:
      - \TeamViewer\RemotePrinting\tvprint.db
      - \TeamViewer\TVNetwork.log
  selection2:
    TargetFilename|contains|all:
      - \TeamViewer
      - _Logfile.log
  condition: 1 of selection*
falsepositives:
  - Legitimate uses of TeamViewer in an organisation
level: medium
license: DRL-1.1
related:
  - id: 162ab1e4-6874-4564-853c-53ec3ab8be01
    type: derived