Windows Process Creation: Renamed Microsoft Teams Executable Launch
Alerts when Microsoft Teams binaries are launched under renamed executable names on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-07-12
- Updated
- 2026-07-30
What it detects
This rule flags Windows process executions where the OriginalFileName indicates Microsoft Teams (msteams.exe or teams.exe) even when the process image name does not match the expected legitimate filenames. Attackers may rename binaries to evade simple allowlists and detection rules that rely on file names. The detection relies on process creation telemetry, specifically the OriginalFileName and the launched executable path or name for comparison against known good patterns.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-renamed-microsoft-teams-executable-launch-88f46b67
title: "Windows Process Creation: Renamed Microsoft Teams Executable Launch"
id: 0edbda7c-f621-4fc2-a4df-fd8b919a5702
status: test
description: This rule flags Windows process executions where the OriginalFileName indicates Microsoft Teams (msteams.exe or teams.exe) even when the process image name does not match the expected legitimate filenames. Attackers may rename binaries to evade simple allowlists and detection rules that rely on file names. The detection relies on process creation telemetry, specifically the OriginalFileName and the launched executable path or name for comparison against known good patterns.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_msteams.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-12
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName:
- msteams.exe
- teams.exe
filter_main_legit_names:
Image|endswith:
- \msteams.exe
- \teams.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 88f46b67-14d4-4f45-ac2c-d66984f22191
type: derived