Windows TeamViewer Remote Session Process Command Line Start

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches process creation for TeamViewer’s desktop executable when it is started via the TeamViewer service and uses a specific IPC port and module argument. Attackers can use remote access tooling like TeamViewer to establish interactive access from a remote host, so correlating this startup command helps identify remote session initiation. It relies on Windows process creation telemetry, specifically the executable path, parent process image, and the command line ending pattern.

Reporting behind it

Related detections9 linkedT1133 — drag to rearrange

SplashTop Network

Suspicious SoftEther VPN Hamcore Config Written to ProgramData (via file_event)

SplashTop Process

AnyDesk Network

OpenCanary RDP New Connection Attempt on Application Logtype 14001

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

FortiGate: Addition of VPN SSL Web Portal via Event Logs

FortiGate SSL VPN Settings Edited

Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

Windows TeamViewer Remote Session Process Command Line Start

Pivot detection · T1133 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-teamviewer-remote-session-process-command-line-start-ab70c354

title: Windows TeamViewer Remote Session Process Command Line Start
id: 92b51f68-6019-4899-bd40-5f7eec4208d5
related:
  - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d
    type: similar
  - id: f459ccb4-9805-41ea-b5b2-55e279e2424a
    type: similar
  - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357
    type: derived
status: test
description: This rule matches process creation for TeamViewer’s desktop executable when it is started via the TeamViewer service and uses a specific IPC port and module argument. Attackers can use remote access tooling like TeamViewer to establish interactive access from a remote host, so correlating this startup command helps identify remote session initiation. It relies on Windows process creation telemetry, specifically the executable path, parent process image, and the command line ending pattern.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml
author: Josh Nickels, Qi Nan, Huntrule Team
date: 2024-03-11
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1133
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image: TeamViewer_Desktop.exe
    ParentImage: TeamViewer_Service.exe
    CommandLine|endswith: TeamViewer_Desktop.exe --IPCport 5939 --Module 1
  condition: selection
falsepositives:
  - Legitimate usage of TeamViewer
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL