MuddyWater Teams Screen Share - VPN Configuration File Access Post Screen-Sharing Session
This rule detects scenarios where Microsoft Teams initiates a potential screen-sharing session (via outbound network connections on specific ports) followed shortly by the access of VPN configuration files on the same host. This sequence may indicate an attacker using screen-sharing to view credentials or configuration details and subsequently attempting to utilize a VPN client.
Splunk (SPL)
