Microsoft Teams Sensitive File Access By Uncommon Applications — Sigma Rule

Rule metadata and linked tags

Author: @SerkinValery. Source status: test; severity: medium. Source dates: 2024-07-22 / not supplied.

{
  "product": "windows",
  "category": "file_access",
  "definition": "Requirements: Microsoft-Windows-Kernel-File ETW provider"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 89bfe2387bf442f87527f5bcb1e3e99fd3255ed7e05660658658ac26240d1831

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Microsoft Teams Sensitive File Access By Uncommon Applications
id: 65744385-8541-44a6-8630-ffc824d7d4cc
status: test
description: |
    Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
references:
    - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
    - https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
author: '@SerkinValery'
date: 2024-07-22
tags:
    - attack.credential-access
    - attack.t1528
logsource:
    product: windows
    category: file_access
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection:
        FileName|contains:
            - '\Microsoft\Teams\Cookies'
            - '\Microsoft\Teams\Local Storage\leveldb'
    filter_main_legit_location:
        # Note: its best to filter the full path to avoid false negatives
        Image|endswith: '\Microsoft\Teams\current\Teams.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
• https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens