Microsoft Teams Desktop Client Fails to Launch on Windows: Availability Incident Response and Defender Playbook

---
title: Microsoft Teams Client Application Crash Detected
description: Detects Windows Application Error events for the Microsoft Teams desktop client or its WebView2 dependency, indicating launch failures consistent with the known Teams startup issue. Use for impact scoping, not alerting at scale.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-says-some-users-cant-open-the-teams-desktop-client/
author: Security Arsenal
date: 2026/04/06
id: 3f8b2c14-7d61-4e92-b05a-9c1e2f4a6b7d
status: experimental
tags:
  - attack.impact
logsource:
  product: windows
  service: application
detection:
  selection_source:
    Provider_Name:
      - 'Application Error'
      - 'Windows Error Reporting'
  selection_process:
    Message|contains:
      - 'ms-teams.exe'
      - 'Teams.exe'
      - 'msedgewebview2.exe'
  condition: selection_source and selection_process
falsepositives:
  - Legitimate application instability unrelated to this incident; tune to count per host rather than per event
level: informational
---
title: Suspicious Teams Fix or Repair Tool Execution
description: Detects execution of binaries masquerading as Microsoft Teams repair/fix utilities, a common malvertising and social engineering lure during publicized Teams outages. Legitimate Teams updates are delivered via Microsoft Update, the Microsoft Store, or managed deployment - never as standalone 'fix' executables.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-says-some-users-cant-open-the-teams-desktop-client/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
id: 6a1d9e83-2c47-4b58-af31-8e5d3c90f214
status: experimental
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith:
      - '\teamsfix.exe'
      - '\teams_fix.exe'
      - '\teamsrepair.exe'
      - '\teams_repair.exe'
      - '\teamsupdate.exe'
      - '\teams-patcher.exe'
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
  condition: selection_name or (selection_path and selection_name)
falsepositives:
  - Rare; internally developed helpdesk tooling with similar naming should be renamed or allowlisted by hash
level: high
---
title: Teams Process Spawning Script Interpreter or Shell
description: Detects the Microsoft Teams client spawning command shells or script interpreters, which is not normal client behavior and may indicate execution of a trojanized or fake Teams package distributed during outage-themed social engineering campaigns.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 92c4b7e1-5f3a-4d68-9c02-1b7e4a58d639
status: experimental
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ms-teams.exe'
      - '\Teams.exe'
      - '\msteams.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; validate any hit immediately rather than tuning broadly
level: high

// Scoping + threat hunt for the Teams desktop client launch issue
// Part 1: Endpoints exhibiting repeated Teams crash behavior (impact scoping)
let TeamsCrash =
DeviceEvents
| where TimeGenerated > ago(24h)
| where ActionType == "AppCrashDetected" or FileName in~ ("ms-teams.exe", "Teams.exe", "msedgewebview2.exe")
| where FileName in~ ("ms-teams.exe", "Teams.exe", "msedgewebview2.exe")
| summarize CrashCount = count(), LastCrash = max(TimeGenerated) by DeviceName, FileName
| where CrashCount >= 3;
// Part 2: Suspicious fake Teams fix/repair tools executed anywhere in the fleet
let FakeFixTools =
DeviceProcessEvents
| where TimeGenerated > ago(72h)
| where FileName has_any ("teamsfix", "teams_fix", "teamsrepair", "teams_repair", "teamsupdate", "teams-patcher")
   or (FolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\Public\\") and FileName has "teams")
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName;
// Part 3: Teams spawning shells or script interpreters (trojanized client behavior)
let TeamsAnomalousChildren =
DeviceProcessEvents
| where TimeGenerated > ago(72h)
| where InitiatingProcessFileName in~ ("ms-teams.exe", "Teams.exe", "msteams.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256;
FakeFixTools
| union TeamsAnomalousChildren
| order by TimeGenerated desc

-- Hunt: Teams client state + suspicious Teams-named executables outside sanctioned paths
-- Sanctioned locations: %LOCALAPPDATA%\Microsoft\Teams, Program Files\WindowsApps (new Teams), Program Files\Teams Installer
LET installs = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/AppData/Local/Microsoft/Teams/*.exe',
  'C:/Program Files/WindowsApps/MSTeams_*/ms-teams.exe'
])

LET suspicious = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/Downloads/*teams*.exe',
  'C:/Users/*/AppData/Local/Temp/*teams*.exe',
  'C:/Users/Public/*teams*.exe'
])
WHERE FullPath !~ '(?i)teams machine-wide installer'

SELECT * FROM installs
UNION ALL
SELECT * FROM suspicious

# Teams Launch Failure - Evidence Capture and Cache Reset Workaround
# Run elevated. Test in a pilot ring before fleet-wide deployment.

$reportPath = "C:\ProgramData\SecurityOps\TeamsRemediation_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
New-Item -ItemType Directory -Path (Split-Path $reportPath) -Force | Out-Null

# 1. Capture recent Teams / WebView2 crash events for IR evidence
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1000,1001} -MaxEvents 200 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'ms-teams|Teams.exe|msedgewebview2' } |
  Select-Object TimeCreated, Id, ProviderName, Message |
  Out-File -FilePath $reportPath -Append

# 2. Record installed Teams version (new Teams is an MSIX/Store package)
Get-AppxPackage -Name 'MSTeams' -AllUsers -ErrorAction SilentlyContinue |
  Select-Object Name, Version, InstallLocation |
  Out-File -FilePath $reportPath -Append

# 3. Stop Teams and WebView2 processes
Get-Process -Name 'ms-teams','Teams','msteams','msedgewebview2' -ErrorAction SilentlyContinue |
  Stop-Process -Force -ErrorAction SilentlyContinue
Start-Sleep -Seconds 3

# 4. Clear new Teams cache (per-user) - forces clean client state on next launch
$cachePaths = @(
  "$env:LOCALAPPDATA\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams",
  "$env:APPDATA\Microsoft\Teams\Cache",
  "$env:APPDATA\Microsoft\Teams\GPUCache",
  "$env:APPDATA\Microsoft\Teams\Code Cache"
)
foreach ($path in $cachePaths) {
  if (Test-Path $path) {
    Remove-Item -Path $path -Recurse -Force -ErrorAction SilentlyContinue
    "Cleared: $path" | Out-File -FilePath $reportPath -Append
  }
}

# 5. Verify WebView2 Runtime presence (new Teams hard dependency)
$webview = Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}' -ErrorAction SilentlyContinue
if ($webview) { "WebView2 Runtime version: $($webview.pv)" | Out-File -FilePath $reportPath -Append }
else { "WARNING: WebView2 Runtime NOT detected - reinstall required." | Out-File -FilePath $reportPath -Append }

Write-Output "Remediation log written to $reportPath"