TeamViewer Remote Session Started On Linux Host

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects the command line executed when TeamViewer starts a session initiated by a remote host. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.