huntrule

Windows Process Creation: Renamed Microsoft Teams Executable Launch

Alerts when Microsoft Teams binaries are launched under renamed executable names on Windows.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: Renamed Microsoft Teams Executable Launch"
id: 0edbda7c-f621-4fc2-a4df-fd8b919a5702
status: test
description: This rule flags Windows process executions where the OriginalFileName indicates Microsoft Teams (msteams.exe or teams.exe) even when the process image name does not match the expected legitimate filenames. Attackers may rename binaries to evade simple allowlists and detection rules that rely on file names. The detection relies on process creation telemetry, specifically the OriginalFileName and the launched executable path or name for comparison against known good patterns.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_msteams.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-12
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName:
      - msteams.exe
      - teams.exe
  filter_main_legit_names:
    Image|endswith:
      - \msteams.exe
      - \teams.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 88f46b67-14d4-4f45-ac2c-d66984f22191
    type: derived

What it detects

This rule flags Windows process executions where the OriginalFileName indicates Microsoft Teams (msteams.exe or teams.exe) even when the process image name does not match the expected legitimate filenames. Attackers may rename binaries to evade simple allowlists and detection rules that rely on file names. The detection relies on process creation telemetry, specifically the OriginalFileName and the launched executable path or name for comparison against known good patterns.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.