Medium RiskWindowsLegitimateCommonly Abused
Skype.exeCOMMUNICATION APPSkype.exe - Skype Communication Security Analysis
Skype.exe is the **Microsoft Skype** communication client. Attackers target Skype for **credential theft**, **malware distribution** via file sharing, and potential **C2 communication**. Skype's trusted status and network access make it an attractive target.
Risk Summary
MEDIUM priority for SOC triage. Skype.exe is a legitimate communication app that can be abused for malware distribution and C2. Monitor for credential theft and Skype running from unexpected locations.
Overview
What is Skype.exe?
Skype is a Microsoft communication platform.
Core Functions
Communication:
- Voice/video calls
- Instant messaging
- File sharing
- Screen sharing
Security Significance
- Trusted Channel: Bypasses some controls
- File Sharing: Malware distribution
- Credential Value: Account theft
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | C:\Program Files*\Skype... |
| Parent | explorer.exe |
| User | Logged-in user |
| Network | Microsoft/Skype servers |
Common Locations
C:\Program Files\Microsoft\Skype for Desktop\Skype.exeC:\Program Files (x86)\Skype\Phone\Skype.exeSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Path: C:\Program Files*\...
Network: Microsoft servers
Behavior: Normal communication
SUSPICIOUS
Path: C:\Temp\Skype.exe
Behavior: Credential file access by other process
Unusual file transfers
Abuse Techniques
Attack Techniques
Technique #1: Credential Theft (T1555)
Stealing Skype login credentials.
Technique #2: Malware Distribution (T1566)
Sending malware via Skype messages/files.
Technique #3: Process Masquerading (T1036.005)
Malware named Skype.exe.
Detection Guidance
Detection Strategies
Priority #1: Path Verification
Process = "Skype.exe" AND
Path NOT CONTAINS "Program Files"
→ ALERT: HIGH
Priority #2: Credential Access
Process != "Skype.exe" AND
FileAccess CONTAINS "Skype\Cookies"
→ ALERT: HIGH
Remediation Steps
Protection and Remediation
Defense: Two-Factor Authentication
Enable 2FA on Microsoft account.
If Compromise Suspected
- Change password
- Review recent activity
- Check for unauthorized sessions
Investigation Checklist
Investigation Checklist
- Verify Skype.exe path
- Check for credential access
- Review sent files
- Check account activity
MITRE ATT&CK Techniques
Last verified: January 18, 2026