Windows TeamViewer Remote Session Process Command Line Start

Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.

FreeUnreviewedSigmalowv1

windows-teamviewer-remote-session-process-command-line-start-ab70c354

title: Windows TeamViewer Remote Session Process Command Line Start
id: 92b51f68-6019-4899-bd40-5f7eec4208d5
related:
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: similar
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: derived
status: test
description: This rule matches process creation for TeamViewer’s desktop executable when it is started via the TeamViewer service and uses a specific IPC port and module argument. Attackers can use remote access tooling like TeamViewer to establish interactive access from a remote host, so correlating this startup command helps identify remote session initiation. It relies on Windows process creation telemetry, specifically the executable path, parent process image, and the command line ending pattern.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: TeamViewer_Desktop.exe
    ParentImage: TeamViewer_Service.exe
    CommandLine|endswith: TeamViewer_Desktop.exe --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

What it detects

This rule matches process creation for TeamViewer’s desktop executable when it is started via the TeamViewer service and uses a specific IPC port and module argument. Attackers can use remote access tooling like TeamViewer to establish interactive access from a remote host, so correlating this startup command helps identify remote session initiation. It relies on Windows process creation telemetry, specifically the executable path, parent process image, and the command line ending pattern.

Known false positives

Legitimate usage of TeamViewer

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.