Microsoft Teams Credential Access via Command Line

Bhojraj Joshi@cybrbhojrajjoshi

•updated Apr 17, 2026•2•0•148

Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.