Potentially Suspicious Command Targeting Teams Sensitive Files
This rule detects command-line activity that attempts to access sensitive Microsoft Teams files, specifically the Cookies or Local Storage\leveldb directories. These locations can contain authentication tokens and other sensitive information. The rule specifically looks for processes other than the legitimate Teams.exe accessing these paths, indicating potential credential theft or unauthorized access.
Sigma
