TeamViewer Domain Query By Non-TeamViewer Application

Status: test
Severity: medium
Log source: category dns_query, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

Known false positives

Unknown binary names of TeamViewer
Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1219.002` Remote Access Tools: Remote Desktop Software

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 22: DNSEvent (DNS query)

Rule body

title: TeamViewer Domain Query By Non-TeamViewer Application
id: 778ba9a8-45e4-4b80-8e3e-34a419f0b85e
status: test
description: Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)
references:
    - https://www.teamviewer.com/en-us/
author: Florian Roth (Nextron Systems)
date: 2022-01-30
modified: 2023-09-18
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName:
            - 'taf.teamviewer.com'
            - 'udp.ping.teamviewer.com'
    filter_main_teamviewer:
        # Note: To avoid evasion based on similar names. Best add full install location of TeamViewer
        Image|contains: 'TeamViewer'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown binary names of TeamViewer
    - Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    QueryName:
        - 'taf.teamviewer.com'
        - 'udp.ping.teamviewer.com'

Stage 2: `not filter_main_teamviewer`

filter_main_teamviewer:
    Image|contains: 'TeamViewer'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	match	`TeamViewer`	`excludes:Image` `field:"Image" value:"TeamViewer"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`QueryName`	eq	`taf.teamviewer.com` `udp.ping.teamviewer.com`	`field:"QueryName" kind:eq`