Detection of TeamViewer Desktop Installation
This brief documents the detection of TeamViewer Desktop installation via file system activity, often associated with Remote Access Software usage.
The installation of TeamViewer Desktop involves the creation of the specific executable 'TeamViewer_Desktop.exe' on the Windows file system. While TeamViewer is legitimate remote support software, its unauthorized or unexpected presence in an enterprise environment can be indicative of Remote Access Software usage (MITRE ATT&CK T1219). Defenders should monitor for the creation of this file to identify potentially unauthorized remote access tools installed within the network. This detection is particularly relevant for organizations with strict software control policies where administrative oversight of remote access utilities is required to prevent unauthorized persistence or exfiltration channels.
Impact
Unauthorized installation of remote access software can provide attackers with persistent, interactive access to internal systems, potentially facilitating data exfiltration, reconnaissance, and command-and-control communication.
Recommendation
- Deploy the Sigma rule below to monitor for the creation of 'TeamViewer_Desktop.exe' using file integrity monitoring or EDR telemetry.
- Audit authorized software lists and investigate instances where TeamViewer is installed on systems not designated for remote support.
- Correlate this file creation event with network connection logs to identify C2 communication patterns associated with remote access tools.
Threat Hunt
Identify all instances of TeamViewer_Desktop.exe in the environment
Data: Endpoint file scan or EDR inventory
Detection coverage 1
Detect TeamViewer Desktop Installation
mediumDetects the creation of TeamViewer_Desktop.exe on the file system
Detection queries are available on the platform. Get full rules →