Windows: Uncommon processes accessing Microsoft Teams Cookies or Local Storage leveldb

title: "Windows: Uncommon processes accessing Microsoft Teams Cookies or Local Storage leveldb"
id: 5131fa5f-cf41-4703-92a8-5a734972722f
status: test
description: This rule flags file access attempts to Microsoft Teams sensitive data stored under Cookies and Local Storage\leveldb when the accessing process is not the Teams client executable. Attackers may harvest authentication material or other locally stored tokens by reading these files. The detection relies on Windows file access telemetry (Microsoft-Windows-Kernel-File ETW) capturing the accessed file path and the accessing image path.
references:
  - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
  - https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_teams_sensitive_files.yml
author: "@SerkinValery, Huntrule Team"
date: 2024-07-22
tags:
  - attack.credential-access
  - attack.t1528
logsource:
  product: windows
  category: file_access
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|contains:
      - \Microsoft\Teams\Cookies
      - \Microsoft\Teams\Local Storage\leveldb
  filter_main_legit_location:
    Image|endswith: \Microsoft\Teams\current\Teams.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 65744385-8541-44a6-8630-ffc824d7d4cc
    type: derived