Suspicious Teams Application Related ObjectAcess Event (25cde13e-8e20-4c29-b949-4e795b76f16f)
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Suspicious Teams Application Related ObjectAcess Event (25cde13e-8e20-4c29-b949-4e795b76f16f) | Sigma-Rules | Steal Application Access Token - T1528 (890c9858-598c-401d-a4d5-c67ebcdd703a) | Attack Pattern | 1 |