Tech Support - LogMeIn/TeamViewer Secondary RAT Drop (T1219)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Identifies an alternative execution path where the Fake Tech Support lure convinces the user to install legitimate remote access tools (LogMeIn, TeamViewer, AnyDesk) which the attacker hijacks. This rule specifically looks for the execution of these tools with the '--kiosk' command-line argument.