Windows Process Creation: Command Line Targets Microsoft Teams Cookies or LevelDB

title: "Windows Process Creation: Command Line Targets Microsoft Teams Cookies or LevelDB"
id: c80818ba-d84e-40fe-a817-212921f2a3d2
status: test
description: This rule flags Windows process creation events where the command line contains paths to Microsoft Teams Cookies or the Local Storage leveldb directory. Accessing these locations can indicate credential or session token harvesting from Teams, which may expose authentication-related data for logged-in accounts. The detection relies on process creation telemetry and command-line/path substring matching, excluding events originating from the Teams executable.
references:
  - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
  - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml
author: "@SerkinValery, Huntrule Team"
date: 2022-09-16
modified: 2023-12-18
tags:
  - attack.credential-access
  - attack.t1528
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - \Microsoft\Teams\Cookies
      - \Microsoft\Teams\Local Storage\leveldb
  filter_main_legit_locations:
    Image|endswith: \Microsoft\Teams\current\Teams.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: d2eb17db-1d39-41dc-b57f-301f6512fa75
    type: derived