.. /Teams.exe
Star

Execute

Electron runtime binary which runs the Teams application


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Generate JavaScript payload and package.json, and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app\\" before executing.

    teams.exe
    Use case
    Execute JavaScript code
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218
  2. Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing.

    teams.exe
    Use case
    Execute JavaScript code
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218
  3. Teams spawns cmd.exe as a child process of teams.exe and executes the ping command

    teams.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c ping google.com &&"
    Use case
    Executes a process under a trusted Microsoft signed binary
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218