Microsoft Teams Sensitive File Access By Unusual Applications (via file_access)

title: Microsoft Teams Sensitive File Access By Unusual Applications (via file_access)
id: a42f807b-a36c-59e4-b5e4-dd8adb4337bb
status: stable
description: This rule detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
references:
    - https://attack.mitre.org/techniques/T1528/
    - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
    - https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
author: 'Huntrule Team'
date: 2026-06-19
tags:
    - attack.credential-access
    - attack.t1528
logsource:
    product: windows
    category: file_access
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection:
        FileName|contains:
            - '\Microsoft\Teams\Cookies'
            - '\Microsoft\Teams\Local Storage\leveldb'
    filter_main_legit_location:
        Image|endswith: '\Microsoft\Teams\current\Teams.exe'
    filter_hr:
        Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\
        Image|endswith: \MsMpEng.exe
    condition: (selection and not 1 of filter_main_*) and not filter_hr
falsepositives:
    - Unknown
level: medium