From ada7f7f6c3f3e3bda1910a9158b24f6c9022082b Mon Sep 17 00:00:00 2001
From: Andrew Kisliakov <lltltk@protonmail.com>
Date: Mon, 17 Jan 2022 08:11:47 +0000
Subject: [PATCH] Microsoft Teams as a LOLbin

---
 yml/OtherMSBinaries/Teams.yml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 yml/OtherMSBinaries/Teams.yml

diff --git a/yml/OtherMSBinaries/Teams.yml b/yml/OtherMSBinaries/Teams.yml
new file mode 100644
index 0000000..1a05057
--- /dev/null
+++ b/yml/OtherMSBinaries/Teams.yml
@@ -0,0 +1,31 @@
+---
+Name: Teams.exe
+Description: Electron runtime binary which runs the Teams application
+Author: Andrew Kisliakov
+Created: 2022-01-17
+Commands:
+  - Command: Teams.exe
+    Description: Generate JavaScript payload and package.json, and save to %LOCALAPPDATA%\Microsoft\Teams\current\app\ before executing.
+    Usecase: Execute JavaScript code
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    OperatingSystem: Windows 7 and up with Microsoft Teams installed
+  - Command: Teams.exe
+    Description: Generate JavaScript payload and package.json, archive in ASAR file and save to %LOCALAPPDATA%\Microsoft\Teams\current\app.asar before executing.
+    Usecase: Execute JavaScript code
+    Category: Execute
+    Privileges: User
+    MitreID: T1218
+    OperatingSystem: Windows 7 and up with Microsoft Teams installed
+Full_Path:
+  - Path: %LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe
+Code_Sample:
+  - Code: https://github.com/lltltk/LOLBAS-research/tree/master/Teams
+Detection:
+  - IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app directory created
+  - IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater
+Resources:
+  - Link: https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/
+Acknowledgement:
+  - Person: Andrew Kisliakov