DragonForce Ransomware: Detecting Microsoft Teams C2 Abuse and Go-Based Access Tools

---
title: Potential C2 via Microsoft Teams by Non-Standard Process
id: 89d4c1e2-a5f3-4b2d-8c1e-1a2b3c4d5e6f
status: experimental
description: Detects potential malicious use of Microsoft Teams infrastructure for C2 by identifying non-Microsoft processes connecting to Teams endpoints. This tracks the behavior of the Go-based tool described in recent reports.
references:
 - https://www.securityweek.com/microsoft-teams-relay-servers-abused-in-dragonforce-ransomware-attack/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   DestinationHostname|contains:
     - 'teams.microsoft.com'
     - 'router.teams.microsoft.com'
   InitiatingProcessFileName|notcontains:
     - 'Teams.exe'
     - 'msteams.exe'
     - 'Microsoft.Teams.exe'
     - 'ms-teams.exe'
 condition: selection
falsepositives:
   - Third-party plugins legitimately integrating with Teams APIs (rare)
   - Custom internal scripts utilizing Teams webhooks
level: high
---
title: Suspicious Process Spawning from Microsoft Teams
description: Detects Microsoft Teams spawning suspicious child processes like PowerShell or CMD. This may indicate exploitation of the client or usage of Teams to launch the Go-based tool.
id: 2f3a4b5c-6d7e-8f9a-0b1c-2d3e4f5a6b7c
status: experimental
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059.003
logsource:
 category: process_creation
 product: windows
detection:
 selection_parent:
   ParentImage|contains:
     - 'Teams.exe'
     - 'msteams.exe'
     - 'Microsoft.Teams.exe'
 selection_child:
   Image|endswith:
     - '\powershell.exe'
     - '\cmd.exe'
     - '\wscript.exe'
     - '\cscript.exe'
     - '\regsvr32.exe'
 condition: all of selection_*
falsepositives:
  - Legitimate administration by IT staff using Teams-integrated tools
level: medium

// Hunt for processes connecting to Teams endpoints that are not the Teams client itself
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "teams.microsoft.com" 
| where InitiatingProcessFileName !in ("Teams.exe", "msteams.exe", "Microsoft.Teams.exe", "ms-teams.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountId, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemotePort
// Optional: Filter for known suspicious extensions or unsigned binaries
| summarize count() by DeviceName, InitiatingProcessFileName

-- Hunt for unusual processes connecting to Teams domains
-- Analyzing network connections and process signatures
SELECT 
  Timestamp, 
  Pid, 
  Name AS ProcessName, 
  CommandLine, 
  Exe, 
  Username,
  Endpoints.Address AS RemoteAddress
FROM chain(
    pslist(), 
    foreach(row={
        SELECT Pid
        FROM netstat(pid=Pid)
        WHERE RemoteAddress =~ '.*teams.microsoft.com.*'
    })
)
WHERE Name !in ('Teams.exe', 'msteams.exe', 'Microsoft.Teams.exe')

# Script to Audit for Suspicious Teams Related Processes
# Requires Administrative Privileges

Write-Host "[+] Starting Audit for Microsoft Teams C2 Abuse..." -ForegroundColor Cyan

# Get processes connecting to Teams domains (requires netstat parsing as process-level network inspection is complex in pure PS)
# Here we focus on the process tree anomaly: Teams spawning shells

$suspiciousParents = @('Teams.exe', 'msteams.exe', 'Microsoft.Teams.exe')
$suspiciousChildren = @('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'regsvr32.exe')

$processes = Get-WmiObject Win32_Process | Select-Object Name, ProcessId, ParentProcessId, CommandLine

foreach ($proc in $processes) {
    if ($suspiciousChildren -contains $proc.Name) {
        $parent = $processes | Where-Object { $_.ProcessId -eq $proc.ParentProcessId }
        if ($parent -and $suspiciousParents -contains $parent.Name) {
            Write-Host "[!] ALERT: Suspicious child process detected!" -ForegroundColor Red
            Write-Host "    Parent: $($parent.Name) (PID: $($parent.ProcessId))" -ForegroundColor Yellow
            Write-Host "    Child : $($proc.Name) (PID: $($proc.ProcessId))" -ForegroundColor Yellow
            Write-Host "    Command Line: $($proc.CommandLine)" -ForegroundColor Yellow
        }
    }
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan
Write-Host "[!] If alerts were found, investigate the specific PID and consider isolating the endpoint." -ForegroundColor Yellow