TeamViewer Remote Access Used for Persistent C2

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects HTTP network connections to TeamViewer domains, specifically 'teamviewer.com' or 'router.teamviewer.com'. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This behavior is indicative of TeamViewer being used for persistent command and control (C2) activities, often associated with trojan activity.