LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Teams.exe

View source

Electron runtime binary which runs the Teams application

Execute
03COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Execute3

EXAMPLE 01T1218.015

Generate JavaScript payload and package.json, and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app\\" before executing.

COMMAND
teams.exe
USE CASE
Execute JavaScript code
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · Node.JS
EXAMPLE 02T1218.015

Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing.

COMMAND
teams.exe
USE CASE
Execute JavaScript code
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · Node.JS
EXAMPLE 03T1218.015

Teams spawns cmd.exe as a child process of teams.exe and executes the ping command

COMMAND
teams.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
USE CASE
Executes a process under a trusted Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · CMD
02 / ON DISK

Known paths

C:\Users\<username>\AppData\Local\Microsoft\Teams\current\Teams.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    %LOCALAPPDATA%\Microsoft\Teams\current\app directory created

  • IOC

    %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Andrew Kisliakov
mr.d0x@mrd0x