Skip to content

Hide Navigation Hide TOC

Remote Access Tool - Team Viewer Session Started On MacOS Host (f459ccb4-9805-41ea-b5b2-55e279e2424a)

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

Cluster A Galaxy A Cluster B Galaxy B Level
External Remote Services - T1133 (10d51417-ee35-4589-b1ff-b6df1c334e8d) Attack Pattern Remote Access Tool - Team Viewer Session Started On MacOS Host (f459ccb4-9805-41ea-b5b2-55e279e2424a) Sigma-Rules 1