sigmaDRL-1.1from SigmaHQ/sigma

Installation of TeamViewer Desktop

TeamViewer_Desktop.exe is create during install

Quality

100

FP risk

—

Forks

Views

ATT&CK techniques

T1219.002

Rule sourcerules/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml

title: Installation of TeamViewer Desktop
id: 9711de76-5d4f-4c50-a94f-21e4e8f8384d
status: test
description: TeamViewer_Desktop.exe is create during install
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows
author: frack113
date: 2022-01-28
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '\TeamViewer_Desktop.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium