Windows: Suspicious access to Microsoft Teams token and local storage objects (4663)

title: "Windows: Suspicious access to Microsoft Teams token and local storage objects (4663)"
id: 1d2529ff-96a3-457b-96b4-e81c2267a66d
status: test
description: This rule flags Windows Security Event ID 4663 when an object related to Microsoft Teams cookies or local storage (leveldb) is accessed. Such activity can indicate attempts to obtain authentication-related data from the Teams desktop application. The detection relies on object access telemetry in Event ID 4663 and narrows matches by excluding access initiated by the Teams.exe process itself.
references:
  - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
  - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml
author: "@SerkinValery, Huntrule Team"
date: 2022-09-16
tags:
  - attack.credential-access
  - attack.t1528
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4663
    ObjectName|contains:
      - \Microsoft\Teams\Cookies
      - \Microsoft\Teams\Local Storage\leveldb
  filter:
    ProcessName|contains: \Microsoft\Teams\current\Teams.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 25cde13e-8e20-4c29-b949-4e795b76f16f
    type: derived