Microsoft Teams Covert Channels Research

With the rise of remote working, Microsoft Teams has become the de-facto standard for video conferences, chat, and collaboration. The nature of the Teams architecture are some central systems that route information between parties. With that comes that Teams client software must be allowed to communicate to the Internet. Microsoft even recommends letting Teams traffic bypass inspection proxies for compatibility reasons. Its network communication pattern has significant overlap with malicious C2 traffic und thus it is nearly impossible for blue …

architecture channel chat client collaboration conferences covert evasion information internet malware detection microsoft microsoft teams nature networking red teaming remote working research software standard systems teams telephony traffic video windows working