Uncommon access to Microsoft Teams credential files

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials (T1552)
Severity	Low

Description

Sensitive Microsoft Teams credential files were accessed.

Attacker's Goals

Accessing these files is done by attackers to collect user credentials.

Investigative actions

Investigate the actor process to determine if it was used for legitimate purposes or malicious activity.

Variations

Uncommon access to Microsoft Teams credential files by an unsigned and unpopular process

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials (T1552)
Severity	Low

Description

Sensitive Microsoft Teams credential files were accessed. by an unsigned and unpopular process.

Attacker's Goals

Accessing these files is done by attackers to collect user credentials.

Investigative actions

Investigate the actor process to determine if it was used for legitimate purposes or malicious activity.