Microsoft Teams Sensitive File Access By Uncommon Applications

 1title: Microsoft Teams Sensitive File Access By Uncommon Applications
 2id: 65744385-8541-44a6-8630-ffc824d7d4cc
 3status: experimental
 4description: |
 5        Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
 6references:
 7    - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
 8    - https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
 9author: '@SerkinValery'
10date: 2024-07-22
11tags:
12    - attack.credential-access
13    - attack.t1528
14logsource:
15    product: windows
16    category: file_access
17    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
18detection:
19    selection:
20        FileName|contains:
21            - '\Microsoft\Teams\Cookies'
22            - '\Microsoft\Teams\Local Storage\leveldb'
23    filter_main_legit_location:
24        # Note: its best to filter the full path to avoid false negatives
25        Image|endswith: '\Microsoft\Teams\current\Teams.exe'
26    condition: selection and not 1 of filter_main_*
27falsepositives:
28    - Unknown
29level: medium

References

• Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs

  

  Security analysts have found a severe security vulnerability in the desktop app for Microsoft Teams that gives threat actors access to authentication tokens and accounts with multi-factor authentication (MFA) turned on.

  
  Read More

• Undermining Microsoft Teams Security by Mining Tokens by Connor Peoples

  

  In August 2022, the Vectra Protect team identified an attack path that enables malicious actors with file system access to steal credentials for any Microsoft Teams user who is signed in. Attackers do not require elevated permissions to read these files, which exposes this concern to any attack that provides malicious actors with local or remote system access.

  
  Read More

Related rules

• Anomalous Token
• Anonymous IP Address
• App Granted Microsoft Permissions
• Application URI Configuration Changes
• Delegated Permissions Granted For All Users