Electron runtime binary which runs the Teams application Located at: C:\Users\<username>\AppData\Local\Microsoft\Teams\current\Teams.exe.
teamsteamsSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Generate JavaScript payload and package.json, and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app\\" before executing. (Execute JavaScript code)
teams.exeGenerate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing. (Execute JavaScript code)
teams.exeTeams spawns cmd.exe as a child process of teams.exe and executes the ping command (Executes a process under a trusted Microsoft signed binary)
teams.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"| Type | Rule / Indicator |
|---|---|
| ioc | %LOCALAPPDATA%\Microsoft\Teams\current\app directory created |
| ioc | %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater |
| sigma | https://github.com/SigmaHQ/sigma/blob/43277f26fc1c81fc98fc79147b711189e901b757/rules/windows/process_creation/proc_creation_win_susp_electron_exeuction_proxy.yml |
teams is a Windows LOLBin. Electron runtime binary which runs the Teams application Located at: C:\Users<username>\AppData\Local\Microsoft\Teams\current\Teams.exe.