Microsoft Teams Sensitive File Access By Uncommon Applications

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•25

Detects attempts by uncommon processes to access sensitive Microsoft Teams files, specifically those containing authentication tokens (leveldb) and cookies. This rule aims to identify potential credential theft or unauthorized access to user sessions within Microsoft Teams.