Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Read More

Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts.

Read More

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Read More

Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

Read More

Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.

Read More

Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD

Read More

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

Read More

Detects when highly privileged delegated permissions are granted on behalf of all users

Read More

Detects when an end user consents to an application

Read More

Detects when end user consent is blocked due to risk-based consent.

Read More

Detects creation of default named pipes used by the Koh tool

Read More

Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.

Read More

Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft

Read More

Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Read More