From e935a7bf0577ae2bcb73462407af538c57be3aa0 Mon Sep 17 00:00:00 2001 From: josehelps Date: Sun, 3 Sep 2023 14:47:48 -0400 Subject: [PATCH] still trying to correct CI fails --- yml/OtherMSBinaries/Teams.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/yml/OtherMSBinaries/Teams.yml b/yml/OtherMSBinaries/Teams.yml index 317be06..146bc80 100644 --- a/yml/OtherMSBinaries/Teams.yml +++ b/yml/OtherMSBinaries/Teams.yml @@ -5,27 +5,28 @@ Author: Andrew Kisliakov Created: 2022-01-17 Commands: - Command: Teams.exe - Description: Generate JavaScript payload and package.json, and save to %LOCALAPPDATA%\Microsoft\Teams\current\app\ before executing. + Description: Generate JavaScript payload and package.json, and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app\\" before executing. Usecase: Execute JavaScript code Category: Execute Privileges: User MitreID: T1218 OperatingSystem: Windows - Command: Teams.exe - Description: Generate JavaScript payload and package.json, archive in ASAR file and save to %LOCALAPPDATA%\Microsoft\Teams\current\app.asar before executing. + Description: Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing. Usecase: Execute JavaScript code Category: Execute Privileges: User MitreID: T1218 OperatingSystem: Windows Full_Path: - - Path: "%LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe" + - Path: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\Teams.exe" Code_Sample: - Code: https://github.com/lltltk/LOLBAS-research/tree/master/Teams Detection: - - IOC: "%LOCALAPPDATA%\Microsoft\Teams\current\app directory created" - - IOC: "%LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater" + - IOC: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app directory created" + - IOC: "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar file created/modified by non-Teams installer/updater" Resources: - Link: https://l--k.uk/2022/01/16/microsoft-teams-and-other-electron-apps-as-lolbins/ Acknowledgement: - Person: Andrew Kisliakov +