MSTeams exe side-loading - Update.exe

calendar Aug 10, 2024 · attack.Defense Evasion attack.T1218  ·
Share on: linkedin copy

Detects execution of side-loaded executable via the update.exe, part microsoft teams' application binary.

Sigma rule (View on GitHub)

 1title: MSTeams exe side-loading - Update.exe
 2id: dafa6fd4-dcda-4ef2-81c9-4bf33ce4c299
 3description: Detects execution of side-loaded executable via the update.exe, part microsoft teams' application binary.
 4status: experimental
 5date: 2022/01/12
 6author: \@kostastsale
 7references:
 8    - https://twitter.com/misconfig/status/1481198346379436035
 9    - https://twitter.com/Kostastsale/status/1481438427878858755
10    - https://github.com/Squirrel/Squirrel.Windows/blob/0d1250aa6f0c25fe22e92add78af327d1277d97d/src/Update/Program.cs#L123
11logsource:
12    category: process_creation
13    product: windows
14detection:
15    selection1:
16        ParentCommandLine|contains|all:
17            - 'AppData\Local\Microsoft\Teams\Update.exe'
18            - '--processStart *.exe'
19        ParentImage|endswith:
20            - 'update.exe'
21    filter:
22        Image|endswith:
23            - 'Teams.exe'
24    condition: selection1 and not filter
25falsepositives:
26    - Unlikely
27level: high
28tags:
29    - attack.Defense Evasion
30    - attack.T1218```

References

Related rules

to-top