Queries/

Get whether TeamViewer is installed/running

AndrewB

Looks for the TeamViewer service running on machines. This is often used when attackers gain access to a machine, running TeamViewer to allow them to access a machine.

To learn more about queries, check this guide.

Query PowerShellNEW BashNEW

SELECT display_name,status,s.pid,p.path FROM services AS s JOIN processes AS p USING(pid) WHERE s.name LIKE "%teamviewer%";

$services = Get-CimInstance -ClassName Win32_Service | Where-Object { $_.Name -like '*teamviewer*' } $results = foreach ($svc in $services) {
    $proc = Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = $($svc.ProcessId)" -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        display_name = $svc.DisplayName
        status       = $svc.State
        pid          = $svc.ProcessId
        path         = if ($proc) { $proc.ExecutablePath } else { 'N/A' }
    }
} $results | Format-Table -AutoSize