// [T1552.001] Microsoft Teams Unsecured Credentials In Files
//
// Reference: https://www.reddit.com/r/crowdstrike/comments/xfqtyb/20220916_cool_query_friday_microsoft_teams/
//
// Use only one of the two queries. 

// Table format
#event_simpleName=ProcessRollup2
| CommandLine=/(\/|\\)Microsoft(\/|\\)(Microsoft\s)?Teams(\/|\\)(Cookies|Local\s+Storage(\/|\\)leveldb)/i
| CommandLine=/Teams(\\|\/)(local\sstorage(\\|\/))?(?<teamsFile>(leveldb|cookies))/i
| groupBy([ParentBaseFileName, ImageFileName, teamsFile, CommandLine], limit=max)