Teamviewer Connection Details

barkin
barkin Posts: 1
in General questions

Hi,
I am looking for information on Teamviewer / Teamviewer_sevice.exe. We have a User (a Developer), so has admin rights to laptop. The user has installed teamviewer. I believe teamviewer_service is what allows some to be able to remote onto said computer.


From the logs with MS Defender ATP (AzureAD/Office365). I can see both appear in the timeline of actions/events.


What i am interested in is if someone is remoted onto the said computer! We believe the user may somewhere else and using this is look like in the UK!!!!!!
Oh i work within the InfoSec department if you wondering why i am asking this.


Any advice to what to look for would be great.


I have entries like this, with different IP address at the end. would any of this have the source IP from where a remote connection would be coming from?


TeamViewer.exe successfully established connection with 127.0.0.1:49868 TeamViewer_Service.exe successfully established connection with 37.252.254.183:5938


Thanks in advance

Tagged:
Trustpilot

Categories

This Week's Leaders