Query: write Sigma for Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been
Matching passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: macos / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On MacOS Host id: f459ccb4-9805-41ea-b5b2-55e279e2424a related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Near-miss passage: Sigma rule: Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access a. Logsource: windows / file_access. Rule: title: Suspicious File Access to Browser Credential Storage id: a1dfd976-4852-41d4-9507-dc6590a3ccd0 status: experimental description: 'Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware. ' references: - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1 - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore date: 2025-05-22 tags: - attack.credential-access - attack.t1555.003 - attack.discovery - attack.t1217 logsource: category: file_access product: windows detection: selection_browser_paths: FileName|contains: - \Sputnik\Sputnik - \MapleStudio\ChromePlus - \QIP Surf - \BlackHawk - \7Star\7Star - \CatalinaGroup\Citrio - \Google\Chrome - \Coowon\Coowon - \CocCoc\Browser - \uCozMedia\Uran - \Tencent\QQBrowser - \Orbitum - \Slimjet - \Iridium - \Vivaldi - \Chromium - \GhostBrowser - \CentBrowser - \Xvast - \Chedot - \SuperBird - \360Browser\Browser - \360Chrome\Chrome - \Comodo\Dragon - \BraveSoftware\Brave-Browser - \Torch - \UCBrowser\ - \Blisk - \Epic Privacy Browser - \Nichrome - \Amigo - \Kometa - \Xpom - \Microsoft\Edge - \Liebao7Default\EncryptedStorage - \AVAST Software\Browser - \Kinza - \Mozilla\SeaMonkey\ - \Comodo\IceDragon\ - \8pecxstudios\Cyberfox\ - \FlashPeak\SlimBrowser\ - \Moonchild Productions\Pale Moon\ selection_browser_subpaths: FileName|contains: - \Profiles\ - \User Data selection_cred_files: - FileName|contains: - \Login Data - \Cookies - \EncryptedStorage - \WebCache\ - FileName|endswith: - cert9.db - cookies.sqlite - formhistory.sqlite - key3.db - key4.db - Login Data.sqlite - logins.json - places.sqlite filter_main_img: Image|endswith: - \Sputnik.exe - \ChromePlus.exe - \QIP Surf.exe - \BlackHawk.exe - \7Star.exe - \Sleipnir5.exe - \Citrio.exe - \Chrome SxS.exe - \Chrome.exe - \Coowon.exe - \CocCocBrowser.exe - \Uran.exe - \QQBrowser.exe - \Orbitum.exe - \Slimjet.exe - \Iridium.exe - \Vivaldi.exe - \Chromium.exe - \GhostBrowser.exe - \CentBrowser.exe - \Xvast.exe - \Chedot.exe - \SuperBird.exe - \360Browser.exe - \360Chrome.exe - \dragon.exe - \brave.e