Remote Access Tool - Team Viewer Session Started On MacOS Host

Title: Remote Access Tool - Team Viewer Session Started On MacOS Host
Status: test
Description:Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
References:
  -Internal Research
Author: Josh Nickels, Qi Nan
Date: 2024-03-11
modified:None
Tags:

• -'attack.persistence'
• -'attack.initial-access'
• -'attack.t1133'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection:
    ParentImage|endswith: '/TeamViewer_Service'
    Image|endswith: '/TeamViewer_Desktop'
    CommandLine|endswith: '/TeamViewer_Desktop --IPCport 5939 --Module 1'
  condition:selection
Falsepositives:
  -Legitimate usage of TeamViewer
Level: low