Detecting TeamViewer Install/Running

[ksnihur]

Description: Looks for the TeamViewer service running on machines. This is used often when attackers gain access to a machine, running TeamViewer to allow them to access a machine.

What The Data Shows: TeamViewer running on a machine.

SQL: 

SELECT display_name,status,s.pid,p.path
FROM services AS s

JOIN processes AS p
USING(pid)

WHERE s.name LIKE "%teamviewer%";

[mided_heier]

Hi, 

This query does not include scenario when you just run TeamViewer (without installing it as a service). In that case you should use condition like shown bellow (process names are tv_w32.exe and/or tv_w32.exe)

SELECT name,path,state
FROM processes AS s
WHERE name LIKE "%tv_w%";