Renamed Microsoft Teams Execution
This rule detects the execution of the Microsoft Teams application when its executable file has been renamed. Adversaries may rename legitimate application binaries to evade detection mechanisms that look for specific file names or paths. The rule specifically looks for processes where the original file name (as embedded in the executable metadata) is 'msteams.exe' or 'teams.exe', but the actual executed image path does not end with these legitimate names, indicating a renaming activity.
Sigma
