Suspicious Teams Application Related ObjectAcess Event

Title: Suspicious Teams Application Related ObjectAcess Event
Status: test
Description:Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
References:
  -https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
  -https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens
Author: @SerkinValery
Date: 2022-09-16
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1528'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4663'
    ObjectName|contains:
      -'\Microsoft\Teams\Cookies'
      -'\Microsoft\Teams\Local Storage\leveldb'

  filter:
    ProcessName|contains: '\Microsoft\Teams\current\Teams.exe'
  condition:selection and not filter
Falsepositives:
  -Unknown
Level: high