SynkLoader Malware via Microsoft Teams Phishing: Detection, Hunting, and Hardening Guide

---
title: Microsoft Teams Spawning Script Interpreter or LOLBIN
id: 4c1f8e2a-7b3d-4e5f-9a6c-2d8b1f4e7a9c
status: experimental
description: Detects Microsoft Teams or Teams-related processes spawning PowerShell, cmd, mshta, rundll32, or regsvr32. Teams social engineering campaigns such as SynkLoader frequently trick users into executing payloads that chain off the Teams process or a browser/support-tool child process spawned during the interaction.
references:
  - https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/
  - https://attack.mitre.org/techniques/T1566/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1566
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ms-teams.exe'
      - '\Teams.exe'
      - '\msedgewebview2.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Teams update or diagnostics activity; validate against signed parent/child pairs and software inventory
level: high
---
title: Loader-Style Persistence via Run Key from User-Writable Path
id: 8e2b5d1f-3c7a-4f9e-b6d2-1a5c8e4f7b3d
status: experimental
description: Detects registry Run key persistence entries pointing to executables in user-writable locations (AppData, Temp, Public, ProgramData with unusual subpaths). SynkLoader-class loaders commonly establish persistence from these paths to survive reboot before rendering the credential-harvesting lock screen.
references:
  - https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
      - '\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
  selection_path:
    Details|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_known_good:
    Image|endswith:
      - '\OneDrive.exe'
      - '\Teams.exe'
      - '\ms-teams.exe'
      - '\Spotify.exe'
      - '\Discord.exe'
      - '\slack.exe'
  condition: selection_key and selection_path and not filter_known_good
falsepositives:
  - Legitimate per-user applications that self-register in Run keys; maintain an allowlist of signed, approved per-user software
level: medium
---
title: Unsigned Process Making Outbound Connection Shortly After User Context Execution
id: 6f3a9c2e-5d1b-4a8f-9e7c-3b2d6f1a8e5c
status: experimental
description: Detects network connections from unsigned or newly observed executables running from user-writable directories. Loader families such as SynkLoader beacon and exfiltrate harvested credentials from processes residing in AppData or similar paths.
references:
  - https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/02/14
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Temp\'
    DestinationPort:
      - 443
      - 80
      - 8443
      - 8080
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\ms-teams.exe'
      - '\Teams.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Per-user installed legitimate applications (Slack, Discord, game launchers); enrich with file signature status and prevalence before triage
level: medium

let Lookback = 14d;
// Stage 1: Teams process spawning script interpreters or LOLBINs
let SuspiciousTeamsChildren = DeviceProcessEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFileName has_any ("ms-teams.exe", "Teams.exe", "msedgewebview2.exe")
| where FileName has_any ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wscript.exe", "cscript.exe")
| project TeamsChildTime = Timestamp, DeviceName, DeviceId, AccountName, ChildProcess = FileName, ChildCmd = ProcessCommandLine, ChildSHA256 = SHA256, FolderPath;
// Stage 2: Persistence created on the same device within 4 hours
let PersistenceEvents = DeviceRegistryEvents
| where Timestamp > ago(Lookback)
| where RegistryKey has_any ("\\CurrentVersion\\Run", "\\CurrentVersion\\RunOnce")
| where RegistryValueData has_any ("\\AppData\\", "\\Users\\Public\\", "\\Temp\\", "\\ProgramData\\")
| project PersistTime = Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine;
SuspiciousTeamsChildren
| join kind=inner PersistenceEvents on DeviceName
| where PersistTime between (TeamsChildTime .. (TeamsChildTime + 4h))
| project DeviceName, AccountName, TeamsChildTime, ChildProcess, ChildCmd, ChildSHA256, PersistTime, RegistryKey, RegistryValueName, RegistryValueData
| order by TeamsChildTime desc

let Lookback = 7d;
DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Users\\Public\\", "\\Temp\\")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "ms-teams.exe", "teams.exe", "onedrive.exe", "spotify.exe", "slack.exe", "discord.exe")
| where RemotePort in (443, 80, 8443, 8080)
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256
| where Connections > 5
| order by FirstSeen desc

-- SynkLoader-style hunt: suspicious processes + persistence from user-writable paths
LET procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)\\\\(AppData|Users\\\\Public|Temp|ProgramData)\\\\'
  AND Name !~ '(?i)(onedrive|teams|ms-teams|spotify|slack|discord|chrome|msedge|firefox)\\.exe'

LET conns = SELECT Pid, Name, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status = 'ESTABLISHED' AND RemotePort IN (80, 443, 8080, 8443)

LET suspicious_net = SELECT * FROM conns
WHERE Pid IN (SELECT Pid FROM procs)

LET runkeys = SELECT Name, Data, KeyPath
FROM glob(globs='HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run*', accessor='registry')
WHERE Data =~ '(?i)(AppData|Users\\\\Public|Temp)'

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, 'RUNKEY: ' + Name AS Name, Data AS CommandLine, KeyPath AS Exe, NULL AS Username, NULL AS CreateTime FROM runkeys

# =============================================
# SynkLoader / Teams Social Engineering Hardening & Sweep
# Run SECTION 1 as Teams Admin | SECTIONS 2-3 on endpoints (elevated)
# =============================================

# ---------- SECTION 1: Teams External Access Audit (Tenant Admin) ----------
# Requires: Install-Module MicrosoftTeams; Connect-MicrosoftTeams
# Goal: confirm external chat is restricted to an allowlist, not open federation.

Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers, AllowedDomains, AllowPublicUsers | Format-List

# HARDENING: If AllowFederatedUsers is $true with no allowlist, restrict to approved partner domains.
# Replace 'partnerdomain.com' with your actual approved external domains.
# $allowed = New-CsEdgeAllowList -AllowedDomain @(New-CsEdgeDomainPattern -Domain "partnerdomain.com")
# Set-CsTenantFederationConfiguration -AllowFederatedUsers $true -AllowedDomains $allowed
# Disable communication with consumer (public) Teams/Skype users:
# Set-CsTenantFederationConfiguration -AllowPublicUsers $false

# OPTIONAL STRONGER CONTROL: Block all inbound external chat at the user-policy layer
# and require external collaboration to happen in shared channels only.
# Set-CsExternalAccessPolicy -Identity "Global" -EnableFederationAccess $false

# ---------- SECTION 2: Endpoint Persistence Sweep ----------
# Flags Run/RunOnce entries pointing to user-writable paths (loader-style persistence).

$suspiciousPaths = 'AppData|Users\\Public|\\Temp\\|ProgramData'
$runKeyLocations = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
$allowlist = 'OneDrive|Teams|Spotify|Slack|Discord'  # tune per environment

foreach ($key in $runKeyLocations) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $value = (Get-ItemProperty -Path $key -Name $_.Name).($_.Name)
            if ($value -match $suspiciousPaths -and $value -notmatch $allowlist) {
                Write-Host "[SUSPICIOUS PERSISTENCE] $key :: $($_.Name) = $value" -ForegroundColor Red
            }
        }
    }
}

# Also enumerate per-user hives for non-interactive coverage
Get-ChildItem 'Registry::HKEY_USERS' | Where-Object { $_.Name -match 'S-1-5-21' } | ForEach-Object {
    $userRun = "Registry::$($_.Name)\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
    if (Test-Path $userRun) {
        Get-ItemProperty -Path $userRun | Get-Member -MemberType NoteProperty | ForEach-Object {
            $value = (Get-ItemProperty -Path $userRun -Name $_.Name).($_.Name)
            if ($value -match $suspiciousPaths -and $value -notmatch $allowlist) {
                Write-Host "[SUSPICIOUS USER PERSISTENCE] $userRun :: $($_.Name) = $value" -ForegroundColor Red
            }
        }
    }
}

# ---------- SECTION 3: Recently Created Executables in User-Writable Paths ----------
# Loader payloads typically land within the last 14 days before execution.

$cutoff = (Get-Date).AddDays(-14)
$scanPaths = @("$env:LOCALAPPDATA", "$env:APPDATA", "C:\Users\Public", "C:\ProgramData")
foreach ($path in $scanPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include *.exe, *.dll, *.ps1, *.hta, *.js -ErrorAction SilentlyContinue |
            Where-Object { $_.CreationTime -gt $cutoff } |
            ForEach-Object {
                $sig = Get-AuthenticodeSignature $_.FullName
                if ($sig.Status -ne 'Valid') {
                    Write-Host "[UNSIGNED NEW FILE] $($_.FullName) | Created: $($_.CreationTime) | Sig: $($sig.Status)" -ForegroundColor Yellow
                }
            }
    }
}

# ---------- SECTION 4: Quick Win — Alert on the Sweep ----------
# Pipe output to your SIEM: wrap sections 2-3 in a scheduled task that logs to the
# Windows Event Log (or forward stdout to your RMM) so SOC gets findings centrally.