UNC6692 Campaign: Defending Against Microsoft Teams Phishing, S3 Payloads, and Snow Malware

---
title: Suspicious Microsoft Teams Child Process
id: 8a4b2c19-1d3e-4f5a-9b6c-7d8e9f0a1b2c
status: experimental
description: Detects Microsoft Teams spawning suspicious child processes like PowerShell or CMD. This is unusual behavior for Teams and indicates potential exploitation or command execution.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://www.darkreading.com/cloud-security/unc6692-social-engineering-malware-cloud-abuse
author: Security Arsenal
date: 2025/04/07
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\msteams.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate debugging by administrators (rare)
  - False positive depends on specific Teams plugins used by organization
level: high
---
title: Browser Downloading Executable from AWS S3
id: 9c5d3e20-2e4f-5g6b-0c7d-1e2f3a4b5c6d
status: experimental
description: Detects web browsers spawning processes that download executables directly from AWS S3 buckets. UNC6692 uses S3 to host payloads.
references:
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2025/04/07
tags:
  - attack.command_and_control
  - attack.t1102
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\curl.exe'
      - '\wget.exe'
      - '\bitsadmin.exe'
  selection_cli:
    CommandLine|contains:
      - 's3.amazonaws.com'
      - '.s3-'
  selection_browser_parent:
    ParentImage|contains:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: (selection_img and selection_cli) or selection_browser_parent
falsepositives:
  - Legitimate developers using AWS CLI tools or scripts
level: medium
---
title: Potential DLL Side-Loading from Temp Directory
id: 0d1e2f30-3f5g-6h7i-8j9k-0l1m2n3o4p5q
status: experimental
description: Detects processes loading DLLs from the user's temporary directory. The "Snow" malware often utilizes side-loading techniques involving dropped DLLs in AppData\Temp.
references:
  - https://attack.mitre.org/techniques/T1574.001/
  - https://attack.mitre.org/techniques/T1574.002/
author: Security Arsenal
date: 2025/04/07
tags:
  - attack.defense_evasion
  - attack.t1574.001
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: '\AppData\Local\Temp\'
    ImageLoaded|endswith:
      - '.dll'
      - '.exe'
  filter:
    Signed: 'false'
  condition: selection and not filter
falsepositives:
  - Installers running from temp directories
  - Browser cache loading
level: medium

// Hunt for External Teams interactions and suspicious S3/Cloudflare traffic
let ExternalTeamsUsers =
    OfficeActivity
    | where Operation =~ "New-IncomingTeamsMeeting" or Operation =~ "MeetingParticipantJoined"
    | where UserId contains "#EXT#" // Identifies external users
    | project TimeGenerated, UserId, Operation, ClientIP;

let SuspiciousNetworkTraffic =
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteUrl contains "s3.amazonaws.com" 
       or RemoteUrl contains "workers.dev"
    | summarize arg_max(Timestamp, *) by DeviceId, RemoteUrl
    | project Timestamp, DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName;

ExternalTeamsUsers
| join kind=inner SuspiciousNetworkTraffic on $left.TimeGenerated == $right.Timestamp // Time correlation
| project TimeGenerated, DeviceName, ExternalUser=UserId, MaliciousDomain=RemoteUrl, Process=InitiatingProcessFileName

-- Hunt for Snow Malware Indicators
SELECT 
    OSPath.Path AS FilePath,
    Size,
    Mtime AS ModifiedTime,
    Mode.String
FROM glob(globs="/*")
WHERE 
    OSPath.Path =~ "C:\\Users\\*\\AppData\\Local\\Temp\\" 
    AND (Name =~ "\\.dll" OR Name =~ "\\.exe")
    AND ModTime < past(hours=24)

UNION

SELECT 
    Pid,
    Ppid,
    Name,
    Exe,
    CommandLine,
    Parent.Name AS ParentName
FROM pslist()
WHERE 
    (Parent.Name =~ "Teams.exe" AND Name =~ "(powershell|cmd|wscript|cscript)")
   OR (Name =~ "Teams.exe" AND CommandLine =~ "--remote-debugging")

# Security Arsenal: Hardening Script for UNC6692 Vector
# Requires SkypeOnlineConnector or Microsoft Teams PowerShell Module

Write-Host "Checking Microsoft Teams External Access Policies..." -ForegroundColor Cyan

try {
    # Check if connector is available, else attempt to connect
    if (-not (Get-Module -ListAvailable -Name MicrosoftTeams)) {
        Write-Warning "MicrosoftTeams module not found. Please install it first."
        exit
    }

    # Connect to Teams (Uncomment if running interactively)
    # Connect-MicrosoftTeams

    $FederationConfig = Get-CsTenantFederationConfiguration
    Write-Host "Current Federation State:" -ForegroundColor Yellow
    Write-Host "  AllowFederatedUsers: $($FederationConfig.AllowFederatedUsers)"
    Write-Host "  RestrictFederatedUsers: $($FederationConfig.RestrictFederatedUsers)"

    $ExternalPolicy = Get-CsExternalAccessPolicy -Global
    Write-Host "Current Global Policy State:" -ForegroundColor Yellow
    Write-Host "  EnableFederationAccess: $($ExternalPolicy.EnableFederationAccess)"
    Write-Host "  EnablePublicCloudAccess: $($ExternalPolicy.EnablePublicCloudAccess)"

    Write-Host "\nREMEDIATION ADVICE:" -ForegroundColor Red
    Write-Host "To block external Teams invitations (High Security):"
    Write-Host 'Set-CsExternalAccessPolicy -Identity Global -EnableFederationAccess $false' -ForegroundColor Green
    
    Write-Host "\nTo allow only specific domains (Allow-listing approach):"
    Write-Host 'Set-CsTenantFederationConfiguration -AllowedDomains "contoso.com,fabrikam.com"' -ForegroundColor Green

} catch {
    Write-Error "An error occurred: $_"
}