Skip to content

Hide Navigation Hide TOC

Remote Access Tool - Team Viewer Session Started On Linux Host (1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d)

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Cluster A Galaxy A Cluster B Galaxy B Level
External Remote Services - T1133 (10d51417-ee35-4589-b1ff-b6df1c334e8d) Attack Pattern Remote Access Tool - Team Viewer Session Started On Linux Host (1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d) Sigma-Rules 1