← Back to SOC feed Coverage →

Remote Management and Monitoring tool - TeamViewer - Network Connection

kql MEDIUM Azure-Sentinel
T1219
DeviceNetworkEvents
huntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-06-01T23:00:00Z · Confidence: medium

Hunt Hypothesis

Unusual network connections to known TeamViewer C2 servers may indicate an adversary leveraging a remote management tool for command and control. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect potential persistent threats using RMM tools as a pivot point.

KQL Query

let Time_start = now(-5d);
let Time_end = now();
//
DeviceNetworkEvents
| where Timestamp between (Time_start..Time_end)
| where RemoteUrl has_any (
        'teamviewer.com',
        'teamviewer.cn'
    )
    and InitiatingProcessVersionInfoCompanyName has 'TeamViewer'
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
    RemoteUrl

Analytic Rule Definition

id: f5023daf-2ac2-407e-b079-6c3bc81d7e25
name: Remote Management and Monitoring tool - TeamViewer - Network Connection
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceNetworkEvents
  | where Timestamp between (Time_start..Time_end)
  | where RemoteUrl has_any (
          'teamviewer.com',
          'teamviewer.cn'
      )
      and InitiatingProcessVersionInfoCompanyName has 'TeamViewer'
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
      RemoteUrl

Required Data Sources

Sentinel TableNotes
DeviceNetworkEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_TeamViewer_netconn.yaml