TeamViewer Log File Deletion
This rule detects the deletion of TeamViewer log files. Adversaries may delete these logs to remove forensic evidence of their activity, making it harder to trace their actions or identify their presence on a system. The rule specifically looks for file deletion events where the target filename contains "\TeamViewer_" and ends with ".log", while excluding deletions performed by 'C:\Windows\system32\svchost.exe' to reduce false positives.
Sigma
