Pages

Friday, 22 November 2019

Hunting for suspicious use of TeamViewer - Part 1/2

N.B: TeamViewer (TV) is a great Remote Support (++) tool, and the objective of this post is to share some threat hunting ideas that could help spot malicious or abnormal usage of such tools (same principles can be applied to other third party legit Remote Support Tools).



Tools such as TV are used in a lot of environment for legit/justified business reasons, and for us as defenders we need to find ways to detect if indeed those tools are used as expected and what are the forensics and real time artefacts that we can leverage to get a better visibility level.

TV Components (High Level):
  • TeamViewer_Service.exe: TV core process which install itself as a standalone service (System Integrity Level)
  • TeamViewer.exe: is the main process for TV user GUI functions (Medium Integrity Level)
  • tv_w32.exe & tv_x64.exe: both used for TV logging (lock access to log file) and hooking specific functions (High IL)
  • TeamViewer_Desktop.exe: executes only when there is an active incoming remote support session via unattended access (System IL)


In term of networking, with exception of TeamViewer_Service.exe, all other processes connect to local host as a form of IPC between TV processes:




TV Netcon behavior can be summarized as below:

teamviwer_desktop.exe|teamviewer.exe:[localhost:high port] <-> teamviewer_service.exe [5939]<->*.teamviewer.com:5938 

In term of logging TV creates the following main "log" files:
  • tvchatfiledownloadhistory.db (encrypted)
  • TeamViewer**_Logfile.log: where * is indicative of TV version, 2 files with same file name one in program files and 2nd is in appdata\roaming)
  • Connections_Incoming.txt : logs time, userid and TV Session ID which can be used to correlate events - incoming connections.
  • Connections_Outgoing.txt: logs time, userid and TV Session ID which can be used to correlate events - outgoing connections.





The most verbose/useful log file is the TeamViwer**_Logfile.log within program files folder and with a DACL set to deny users from writing or changing the content of the file (administrators can of course delete the whole log file).

Logging is ON by default but can be turned off via GUI or setting propoerly certain registry values:


Once the logging is truned off (e.g. via GUI), following registry values get created (by default they get created only if you want to disable logging):



In this 1st part we will be covering the following hunting scenarios:
  1. Tampering attempts with TV logging
  2. File Transfer from attacker machine to TV client
  3. Request to autorize a new device (by default TV send email notification for the 1st time a new device connects to a TV client)
a) Defense Evasion - TV Logging Disabled:



b) File Transfer:

  • If tansfer is done using TV transfer files feature then the file creation on destination machine (TV client) will be logged as following:


While reviweing File Creation activity using production historical data, it shows that TeamViewer.exe usually create few files and majority of them are caching related files in:
  • AppData\Local\Microsoft\Windows\INetCache\IE\*
  • AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\*
So if you are interested to be informed of what files were dropped via TeamViewer File Transfer then use Sysmon or your EDR to monitor/hunt file creation activities by process name TeamViewer.exe.  We can also see traces ("FileDataSinkFileListWin::CreateFileInternal" and PID of TeamViewer.exe) of file transfer activity in the TeamViewer**_LogFile.log:



Unfortunately if the file was dropped via Drag and drop it's logged as being created by explorer.exe:


Looking at traces of file transfer within TeamViewer**_Logfile.log (program files) we can clearly see the explorer.exe PID (5244) and also clues ("DragInterceptor: Interception successful") about a file transfer activity:



For outbound file transfer (from TV client to attacker machine), Teamviewer.exe will read the file, then send it over the IPC netcon (port 5939) to TeamViewer_service.exe which send it to the *.teamviewer.com (port 5938)



All the transfered file names are not captured in the "TeamViewer**_LogFile.log", but high likely are captured in the tvchatfiledownloadhistory.db (encrypted/protected - will be covered in part 2).

c) New Device Autorization:

If the online (TV unattended access) credentials were compromised, once the attacker will try to logon for first time and supposedly that TV account is linked to the corporate email address, then high likely you can detect this notification email via your mail security gateway (custom message filter) which can be of huge value at warning your SOC and the TV account owner to reset the password before the damage is done (btw: enable TV 2FA ASAP!)



As a conclusion for this 1st part, you will need to understand it's usage mode (incoming or outgoing) as well as file transfer activity (needed/no) which can be disabled if not needed, alert on TV log file tampering including the log file deletion (if your EDR supports file deletion logging) and lastly make sure to enable 2FA for this kind of Remote Support tools even if it's rarely used.


That's all for this part, see you in part 2.







103 comments:

  1. Great set of tips from the master himself. Excellent ideas. Anyone wishing to take their blogging forward must read these tips. Thank you .TeamViewer 15.8.3 Crack + License Key Torrent 2020 Free Download

    ReplyDelete
  2. I prefer using secured remote access tools like on premise R-HUB remote support servers. We use it because it works from behind the firewall, thus providing better security to all our remote support sessions.

    ReplyDelete
  3. TeamViewer Crack This is a very helpful site for anyone, each and every man can easily operate this site and can get benefistss

    ReplyDelete
  4. After looking through a few blog articles on your website,
    we sincerely appreciate the way you blogged.
    We've added it to our list of bookmarked web pages and will be checking back in the near
    future. Please also visit my website and tell us what you think.
    fullcrackedpc.com
    Elsten Software Bliss Crack
    O&O BrowserPrivacy Crack
    TeamViewer Crack
    MorphVox Pro Crack
    Arcade VST Output Crack

    ReplyDelete
  5. Really Appreciable Article, Honestly Said The Thing Actually I liked The most is the step-by-step explanation of everything needed to be known for a blogger or webmaster to comment, I am going show this to my other blogger friends too.
    crackglobal.com
    o-browserprivacy-crack

    ReplyDelete
  6. I am very impressed with your post because this post is very beneficial for me and provide a new knowledge to me
    Duolingo Mod APK
    Apowersoft Watermark Remover Crack
    Movavi Slideshow Maker Crack
    OneSafe PC Cleaner Pro Crack

    ReplyDelete
  7. TEAMVIEWER CRACK Excellent post. I was checking constantly this blog and I’m impressed! Very useful information particularly the ultimate phase.I handle such info a lot. I used to be looking for this particular information for a very long time. Thanks and best of luck

    ReplyDelete
  8. Wonderful work! This is the kind of info that are meant to be shared across the internet. Disgrace on the search engines for not positioning this post higher! Come on over and consult with my website.
    So, I would like to Share Nitro Pro Crack with you.
    PassFab for RAR Crack

    ReplyDelete

  9. I like your all post. You have done really good work. Thank you for the information you provide, it helped me a lot. I hope to have many more entries or so from you.
    Very interesting blog.
    wincracker.com
    TeamViewer Crack
    DxO PhotoLab crack
    IsoBuster Pro crack

    ReplyDelete
  10. Adobe Character Animator Cracked as well as expert animation for controlling the movement of characters to take care of sensory movements and thoughts, as well as expert animation. The natural interface allows you to work as actively as possible as it provides intelligent movement tools that provide
    Malwarebytes 4.3.0.210 Crack + Serial Key 2021 For {Win&Mac}

    Mountain Duck Crack 4.3.3.17396 MAC & Full Serial Keygen [Latest] 2021
    NCH Express Zip 7.42 crack + Serial Key Free Download [Latest]
    MakeMKV 1.15.4 Crack + Serial Number Free Download [2021]
    NordVPN 6.34.5.0 Crack + Premium License Key [Latest 2021]

    ReplyDelete


  11. Nitrogen fertilisers and nitrogen are the most important for plants, animals, and human beings. It plays a direct role in the growth and developmental related processes of the plants.
    phenomenon of Brownian motion
    Amazing Health Benefits of Using Cinnamon
    Iron Biofortification of Plants for Improved Human Health
    soilplantfood.com


    Nitrogen fertilisers and nitrogen are the most important for plants, animals, and human beings. It plays a direct role in the growth and developmental related processes of the plants.
    Soil Fertility Management to Improve Food Production
    Calibration and interpretation of soil testing
    Food Scraps as Valuable Resources
    soilplantfood.com

    ReplyDelete
  12. If you want to download the latest version of this software so links are given below!
    MorphVox Pro Crack
    iSkysoft iMedia Converter Deluxe Crack
    MAGIX SOUND FORGE Pro Crack

    ReplyDelete
  13. Such a Nice post.#Thanks For sharing this kind of information /nch-express-zip-crack// You can also visit my Website crackinges.com

    ReplyDelete
  14. Such a nice post.#Thanks for sharing this kind of information morphvox-pro-crack You can also visit my Website ukcrack.com

    ReplyDelete
  15. Such a nice post.#Thanks for sharing this kind of information nch-express-zip-crack You can also visit my Website ukcrack.com

    ReplyDelete
  16. Thanks for sharing the crack but you need to update this version because here new version Available below;

    https://licensedinfo.com/team-viewer-crack/

    ReplyDelete
  17. Very good article! We will be linking to this particularly great post on our website. Keep up the good writing.
    However, stopping by with great quality writing, it's hard to see any good blog today.
    wincracker.com
    File Viewer Plus Crack
    Wise Care Pro Crack
    EaseUS Data Recovery Wizard Pro Crack

    ReplyDelete
  18. Great set of tips from the master himself. Excellent ideas. Thanks for Awesome tips Keep it up
    mobaxterm-crack
    teamviewer-crack
    ultramixer-crack
    faststone-capture-crack

    ReplyDelete
  19. Great work with hard work you have done I appreciate your work thanks for sharing it
    MakeMKV Pro Crack

    ReplyDelete

  20. I thought this was a pretty interesting read when it comes to this topic. Thank you
    master-pdf-editor-crack
    teamviewer-crack
    avocode-crack

    ReplyDelete
  21. USB Disk Security Crack
    Therefore, the execution of junk files or unwanted programs is not allowed while the USB is connected to the system.

    ReplyDelete
  22. It is the best website for all of us. It provides all types of software and apps which
    we need. you can visit this website.
    topcrackpatch.com
    driver-talent-pro-crack

    ReplyDelete
  23. Great work with the hard work you have done I appreciate your work thanks for sharing it...
    Autodesk Maya Crack

    ReplyDelete
  24. Many thanks for sharing such incredible knowledge. It's really good for your Website.
    The info on your website inspires me greatly. This website I'm bookmarked. Maintain it and thanks again.
    I'm really impressed with your writing skills, as smart as the structure of your weblog.

    Security Monitor Pro Crack
    WeatherSnoop Crack
    Aseprite Crack

    ReplyDelete

  25. Amazing blog! I really like the way you explained such information about this post with us. And blog is really helpful for us this website
    allsoftwarepro.com
    babylon-pro-ng-crack
    file-viewer-plus-crack
    prosoft-data-rescue-pro-crack
    my-privacy-cleaner-pro-crack

    ReplyDelete
  26. I am very impressed with your post because this post is very beneficial for me and provide a new knowledge to me

    Movavi Slideshow Maker Crack
    3D Coat Crack
    Photoscape X Pro Crack

    ReplyDelete

  27. Pakistan no.1 Article in my softcrackersstore.com site Now just 1 click to download!
    Driver Talent Pro Crack
    Adobe Photoshop CC Crack

    ReplyDelete
  28. Amazing! Its a genuinely remarkable piece of writing, I
    have got much clear idea on the topic from this post.
    Doctor Pro Device

    ReplyDelete
  29. I guess I am the only one who came here to share my very own experience. Guess what!? I am using my laptop for almost the past 2 years, but I had no idea of solving some basic issues. I do not know how to Download Cracked Pro Softwares But thankfully, I recently visited a website named procrackhere.com
    Cubase Pro Crack
    Norton Security Crack
    GraphPad Prism Crack
    PhpStorm Crack

    ReplyDelete
  30. Amazing! Its a genuinely remarkable piece of writing, I
    have got much clear idea on the topic from this post.
    Fast Stone Capture

    ReplyDelete
  31. This site have particular software articles which emits an impression of being a significant and significant for you individual, able software installation.This is the spot you can get helps for any software installation, usage and cracked.
    https://crackexe.net/https://crackexe.net/
    cyberlink-powerdirector-crack
    nitro-pro-crack
    avocode-crack
    reaper-crack
    tuneskit-spotify-music-converter-crack
    itools-crack
    airmail-crack
    cyberghost-vpn-crack

    ReplyDelete
  32. I am very impressed with your post because this post is very beneficial for me and provide a new knowledge to me

    Avid Pro Tools Crack
    Duplicate File Detective Enterprise Crack
    TransMac Crack

    ReplyDelete
  33. Is this a paid topic or do you change it yourself?
    However, stopping by with great quality writing, it's hard to see any good blog today.

    Clip Studio Paint EX Crack
    AirMyPC Crack

    ReplyDelete
  34. Thanks For Sharing, Here New Version Available;

    https://licensedinfo.com/team-viewer-crack/

    ReplyDelete
  35. It is the best website for all of us. It provides all types of software and apps which we need. You can visit this website.
    ashampoo-pdf-pro-crack
    infix-pdf-editor-pro-crack
    fitness-manager-crack
    total-commander-crack

    ReplyDelete
  36. Thanks for sharing your knowledge to install & crack the Time Tables, but you need to update it now. because there is a 2022 version available now.
    solidworks-crack
    tuneskit-spotify-converter-crack

    ReplyDelete
  37. I am very impressed with your post because this post is very beneficial for and provides new knowledge to me. Thanks for sharing.
    Garden Planner Crack i

    ReplyDelete
  38. Great work with the hard work you have done I appreciate your work thanks for sharing it...
    GOM Player Plus Crack

    ReplyDelete
  39. Wow, amazing block structure! How long
    Have you written a blog before? Working on a blog seems easy.
    The overview of your website is pretty good, not to mention what it does.
    In the content!
    WinRAR 6.02 Crack

    ReplyDelete
  40. Many thanks for sharing such incredible knowledge. It's really good for your website.
    The info on your website inspires me greatly. This website I'm bookmarked. Maintain it and thanks again.
    I'm really impressed with your writing skills, as smart as the structure of your weblog.
    Nitro Pro Crack

    ReplyDelete


  41. Many thanks for sharing such incredible knowledge. It's really good for your website.
    The info on your website inspires me greatly. This website I'm bookmarked. Maintain it and thanks again.
    I'm really impressed with your writing skills, as smart as the structure of your weblog.
    PhpStorm Crack

    ReplyDelete
  42. driver-magician-crack
    <a href="https://keygen4u.com/driver-magician-crack/

    ReplyDelete
  43. I use backwards-facing accessories however I understand that we live in a movable apple, and that you might be in a hurry to complete the most enjoyable sessions. Whatever the occasion, whether it a trip, an independent ludhiana elegant models banquet event or just a casual meeting, my intention is to make sure we both have an unforgettable experience.
    what's app jalandhar girls number.
    what's app amritsar girls number.
    what's app Chandigarh girls number.
    what's app Pathankot girls number.
    what's app Mohali girls number.
    what's app Ludhiana girls number.

    ReplyDelete
  44. Amazing blog! I really like the way you explained such information about this post with us. And blog is really helpful for us this website
    Corel WinDVD Pro Crack
    Apowersoft Video Editor Crack
    FxSound Enhancer Crack
    RonyaSoft Poster Designer Crack
    SlimWare DriverUpdate Crack
    cracksite.net

    ReplyDelete
  45. Many thanks for sharing such incredible knowledge. It's really good for your website.
    The info on your website inspires me greatly. This website I'm bookmarked. Maintain it and thanks again.
    I'm really impressed with your writing skills, as smart as the structure of your weblog.
    Movavi Screen Recorder Crack

    ReplyDelete
  46. Thanks for sharing your knowledge to install & crack the Time Tables, but you need to update
    it now. because there is a 2022 version available now.
    keygen4u.com
    <a href="https://keygen4u.com/renee-iphone-recovery-crack/

    ReplyDelete
  47. All kinds of apps are available here. Visit my site.
    I hope it will prove helpful for you.
    Good Work! Keep It Up.
    It's An Amazing Site.
    Apowersoft Screen Recorder Crack

    AquaSoft SlideShow Ultimate Crack

    EF Commander Crack

    Topaz DeNoise AI Crack

    ReplyDelete
  48. Many thanks for sharing such incredible knowledge. It's really good for your website.
    The info on your website inspires me greatly. This website I'm bookmarked. Maintain it and thanks again.
    I'm really impressed with your writing skills, as smart as the strucAOMEI
    FastStone Capture Crack

    ReplyDelete
  49. If you want to Download the latest version of this software so Link Given Below!
    TopCracks.net
    Onesafe PC Cleaner Pro crack
    AIDA64 Extreme/Engineer crack

    ReplyDelete
  50. My response on my own website. Appreciation is a wonderful thing...thanks for sharing keep it up. NCH Express Zip Crack

    ReplyDelete
  51. This site have particular software articles which emits an impression of being a significant and significant for you individual, able software installation.This is the spot you can get helps for any software installation, usage and cracked.
    windscribe-crack-free-download
    serato-dj-pro-crack-license-key
    bandicam-crack-keygen
    spynote-cracked-tutorial-latest

    ReplyDelete
  52. Pretty great post. I simply stumbled upon your blog and wanted to mention that I have really loved surfing around your blog posts.
    OpenShot Video Editor Crack
    Kerio Control Crack
    PrivateVPN Crack
    Gravit Designer Pro Crack
    RoboForm Pro Crack
    windowsup.net

    ReplyDelete

  53. Great set of tips from the master himself. Excellent ideas. Thanks for Awesome tips Keep it up
    novapdf-pro-crack

    ReplyDelete
  54. Your Content is amazing and I am glad to read them. Thanks for sharing the Blog.this blog is very helpful information for every one.
    english short english stories

    ReplyDelete
  55. Is this a paid topic or do you change it yourself?
    However, stopping by with great quality writing, it's hard to see any good blog today.
    installcrack.com
    iSkysoft PDF Editor Pro crack
    MAGIX Video Pro X crack'
    Sejda PDF Desktop Pro crack
    PDF XChange Editor Plus crack
    Spectrasonics Omnisphere crack

    ReplyDelete
  56. Genuinely when someone doesn’t understand after that its up to other visitors that they will help, so here it happens.|

    야동
    휴게텔
    횟수 무제한 출장
    스포츠마사지
    카지노

    ReplyDelete
  57. This site has particular software articles which emit an impression of being a significant and significant for you individual, able software installation. This is the spot you can get helps for any software installation, usage, and crack.
    lumen-pro-keygen download

    ReplyDelete
  58. So nice I am enjoying that post as for u latest version of this Security tool Available
    prosoft-data-rescue-pro-full license key download

    ReplyDelete
  59. This site have particular software articles which emits an impression of being a significant and significant for you individual, able software installation.This is the spot you can get helps for any software installation, usage and cracked.
    https://crackexe.net/https://crackexe.net/
    iexplorer-crack
    corel-draw-crack

    ReplyDelete
  60. So nice I am enjoying for that post as for u latest version of this Security tool Available.
    IsoBuster Crack
    windowsup.net

    ReplyDelete
  61. So nice I am enjoying for that post as for u latest version of this Security tool. You can visit this website Click here..
    teamviewer-crack
    corel-videostudio-crack
    hide-my-ip-crack
    google-nik-collection-crack

    ReplyDelete
  62. It is the best website for all of us. It provides all types of software and apps which we need. You can visit this website.
    wondershare-dr-fone-crack

    ReplyDelete
  63. Very wonderful informative article. I appreciated looking at your article. Very wonderful reveal. I would like to twit this on my followers. Many thanks! 스포츠토토

    ReplyDelete
  64. Nice blog and absolutely outstanding. You can do something much better but i still say this perfect.Keep trying for the best 바카라사이트

    ReplyDelete
  65. Just desire to say your article is as astonishing. The clarity on your submit is just great and that i can assume you are an expert in this subject. 토토사이트

    ReplyDelete
  66. As I website possessor I believe the content material here is rattling great , appreciate it for your hard work. You should keep it up forever! Best of luck. 카지노사이트

    ReplyDelete
  67. I’ve read some good stuff here. Definitely worth bookmarking for revisiting. I surprise how much effort you put to create such a great informative website. VISIT: 온라인카지노

    ReplyDelete
  68. Hello There. I discovered your blog using msn. That is a really well written article.
    I will be sure to bookmark it and come back to learn extra of your helpful information.

    VISIT NOW: 스포츠토토탑

    ReplyDelete
  69. If you want to download the latest version of this software so links are given below
    We've added it to our list of bookmarked web pages and will be checking back in the near
    future. Please also visit my website and tell us what you think.

    PassFab For RAR Crack
    AOMEI Partition Assistant Crack
    Artlantis Crack
    Freemake Video Converter Crack

    ReplyDelete