Windows File Writes of TeamViewer Session Logs
Flags Windows file creation events for TeamViewer session log artifacts like vprint.db and TVNetwork.log.
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-30
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies file creation events involving TeamViewer-specific log and remote printing database paths. Attackers and remote-access tools may generate these artifacts during interactive sessions, making them useful for confirming remote activity or investigation timelines. It relies on Windows file event telemetry capturing target file paths and filenames ending in or containing the specified TeamViewer log/database patterns.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Writes of TeamViewer Session Logs
id: b48ff7af-4028-43ed-a5cd-402dda782277
status: test
description: This rule identifies file creation events involving TeamViewer-specific log and remote printing database paths. Attackers and remote-access tools may generate these artifacts during interactive sessions, making them useful for confirming remote activity or investigation timelines. It relies on Windows file event telemetry capturing target file paths and filenames ending in or containing the specified TeamViewer log/database patterns.
references:
- https://www.teamviewer.com/en-us/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-01-30
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: file_event
detection:
selection1:
TargetFilename|endswith:
- \TeamViewer\RemotePrinting\tvprint.db
- \TeamViewer\TVNetwork.log
selection2:
TargetFilename|contains|all:
- \TeamViewer
- _Logfile.log
condition: 1 of selection*
falsepositives:
- Legitimate uses of TeamViewer in an organisation
level: medium
license: DRL-1.1
related:
- id: 162ab1e4-6874-4564-853c-53ec3ab8be01
type: derived