Query: rule covering Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than T
Matching passage: Sigma rule: Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than T. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Command Targeting Teams Sensitive Files id: d2eb17db-1d39-41dc-b57f-301f6512fa75 status: test description: 'Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts. ' references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2022-09-16 modified: 2023-12-18 tags: - attack.credential-access - attack.t1528 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter_main_legit_locations: Image|endswith: \Microsoft\Teams\current\Teams.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation id: f8931561-97f5-4c46-907f-0a4a592e47a7 status: experimental description: 'Detects attempted file load events that did not meet the signing level requirements. It often means the file''s signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation. ' references: - https://twitter.com/SBousseaden/status/1483810148602814466 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-20 modified: 2025-02-28 tags: - attack.execution logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3033 - 3034 filter_optional_dtrace: FileNameBuffer|endswith: \Program Files\DTrace\dtrace.dll ProcessNameBuffer|endswith: \Windows\System32\svchost.exe RequestedPolicy: 12 filter_optional_av_generic: FileNameBuffer|contains: \Windows\System32\DriverStore\FileRepository\ FileNameBuffer|endswith: \igd10iumd64.dll RequestedPolicy: 7 filter_optional_electron_based_app: FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll ProcessNameBuffer|endswith: - \AppData\Local\Keybase\Gui\Keybase.exe - \Microsoft\Teams\stage\Teams.exe RequestedPolicy: 8 filter_optional_bonjour: FileNameBuffer|endswith: \Program Files\Bonjour\mdnsNSP.dll ProcessNameBuffer|endswith: - \Windows\System32\svchost.exe - \Windows\System32\SIHClient.exe RequestedPolicy: - 8 - 12 filter_optional_msoffice_1: FileNameBuffer|contains: \Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE FileNameBuffer|endswith: \MSOXMLMF.DLL RequestedPolicy: 7 filter_optional_msoffice_2: ProcessNameBuffer|contains: \Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office FileNameBuffer|contains: \Windows\System32\ RequestedPolicy: 8 filter_optional_slack: FileNameBuffer|endsw