LOL · OtherMSBinary

Teams.exe

3 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Generate JavaScript payload and package.json, and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app\\" before executing.

Use Execute JavaScript code

teams.exe

Context: user
Native: Execute
MITRE: T1218.015
Detection: IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app directory created
IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater
Sigma: github.com/SigmaHQ/sigma/blob/43277f26fc1c81fc98fc79147b711189e901b757/rules/windows/process_creation/proc_creation_win_susp_electron_exeuction_proxy.yml
Refs: l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/
lolbas-project.github.io/lolbas/OtherMSBinaries/Teams/

Execute

Execution Windows

Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing.

Use Execute JavaScript code

teams.exe

Context: user
Native: Execute
MITRE: T1218.015
Detection: IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app directory created
IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater
Sigma: github.com/SigmaHQ/sigma/blob/43277f26fc1c81fc98fc79147b711189e901b757/rules/windows/process_creation/proc_creation_win_susp_electron_exeuction_proxy.yml
Refs: l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/
lolbas-project.github.io/lolbas/OtherMSBinaries/Teams/

Execute

Execution Windows

Teams spawns cmd.exe as a child process of teams.exe and executes the ping command

Use Executes a process under a trusted Microsoft signed binary

teams.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"

Context: user
Native: Execute
MITRE: T1218.015
Detection: IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app directory created
IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater
Sigma: github.com/SigmaHQ/sigma/blob/43277f26fc1c81fc98fc79147b711189e901b757/rules/windows/process_creation/proc_creation_win_susp_electron_exeuction_proxy.yml
Refs: l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/
lolbas-project.github.io/lolbas/OtherMSBinaries/Teams/