Threat Overview
Microsoft documented two human-operated intrusions in which attackers impersonated corporate IT support through external Microsoft Teams messages and calls, convinced users to start Quick Assist sessions, staged portable Python/Bun/Java runtimes from user-writable paths, and abused Active Directory Certificate Services misconfigurations. One path used ESC1 templates permitting requester-supplied identity details; another coerced domain-controller NTLM authentication with PetitPotam and relayed it to AD CS Web Enrollment (ESC8). Certificate-backed access can survive password resets until the certificate and active tickets are invalidated. A privileged identity excluded from automated containment enabled subsequent Rclone-based SFTP exfiltration in the first case.
References
Microsoft Security Research — 2026-10-30
The Hacker News reporting — 2026-11-02
Microsoft NTLM relay hardening KB5005413
Impacted Systems
Vendor/products: Microsoft Teams (cloud collaboration, social-engineering entry only; not vulnerable software), Windows Quick Assist (remote support), Windows Server Active Directory Domain Services and Active Directory Certificate Services (on-prem/hybrid), Microsoft Defender for Identity (optional detection). Affected configurations: ESC1 authentication-capable certificate templates with requester-supplied identity and broad enrollment; ESC8 Web Enrollment accepting relayable NTLM without sufficient protection. Specific vulnerable Windows Server builds are not claimed; Windows Server 2025 enables EPA by default for AD CS, while older deployments may need manual hardening. Exposure: Teams external communication to users and an authorized remote-help session; domain connectivity to a misconfigured CA. No patch version applies to the social-engineering chain.
Why this matters
A user-approved remote-support session can become domain-level access through certificate misconfiguration. Password resets alone do not revoke a maliciously issued certificate.
Exploitation Status
Confirmed intrusion activity. Microsoft Security Research published two investigated cases on October 30, 2026. One included privileged certificate issuance, DCSync and data exfiltration. The other used NTLM relay and domain-controller certificate impersonation before containment. This is not a Teams software vulnerability and no affected/fixed Teams version exists.
Observed activity / IOCs and caveats: Observed: external Teams support impersonation, Quick Assist, KB-themed extracted archives, portable runtimes, AD CS enumeration, ESC1 privileged certificate issuance or PetitPotam/ESC8 relay, PKINIT, DCSync, SMB access and renamed Rclone (SearchApp.exe) copying to SFTP. Microsoft published SHA256 initial-stage script hashes 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17, f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001, and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7. No threat group attribution.
What this hunt looks for
Broad MSSP applicability across hybrid Microsoft environments, with concrete confirmed credential escalation and data theft. Unlike generic Teams phishing, this report links remote-help sessions, portable runtimes, certificate issuance and directory replication into a single detection chain.
Required logs
DeviceNetworkEvents; DeviceProcessEvents; SecurityAlert; SecurityEvent — only where ingested into Microsoft Sentinel. No customer workspace was queried.
A01 — Defender alerts for AD CS abuse and directory replication
Required: SecurityAlert.
SecurityAlert
| where TimeGenerated >= ago(30d)
| where AlertName has_any ('ESC1','ESC8','certificate services','certificate template','NTLM relay','DCSync','suspicious certificate') or Description has_any ('ESC1','ESC8','DCSync','certificate enrollment')
| project TimeGenerated, AlertName, AlertSeverity, CompromisedEntity, Description, ProviderName
| order by TimeGenerated descA02 — Quick Assist followed by portable runtime execution
Required: DeviceProcessEvents.
let Remote = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ 'QuickAssist.exe'
| project DeviceId, DeviceName, RemoteTime=TimeGenerated, RemoteUser=AccountName;
let Runtimes = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ('python.exe','pythonw.exe','bun.exe','java.exe','javaw.exe') or ProcessVersionInfoOriginalFileName in~ ('python.exe','bun.exe','java.exe')
| where FolderPath has_any ('\\Users\\','\\Downloads\\','\\AppData\\','\\Temp\\')
| project DeviceId, RuntimeTime=TimeGenerated, Runtime=FileName, FolderPath, ProcessCommandLine, AccountName;
Remote
| join kind=inner Runtimes on DeviceId
| where RuntimeTime between (RemoteTime .. RemoteTime + 2h)
| project RemoteTime, RuntimeTime, DeviceName, RemoteUser, Runtime, FolderPath, ProcessCommandLine, AccountName
| order by RuntimeTime descA03 — User-writable portable runtime with AD reconnaissance
Required: DeviceProcessEvents.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FolderPath has_any ('\\Users\\','\\Downloads\\','\\AppData\\','\\Temp\\')
| where FileName in~ ('python.exe','pythonw.exe','bun.exe','java.exe','javaw.exe') or ProcessVersionInfoOriginalFileName in~ ('python.exe','bun.exe','java.exe')
| where ProcessCommandLine has_any ('certutil','certreq','ldap','whoami','nltest','net group','dsquery','ipconfig','tasklist')
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated descA04 — AD CS certificate requests and issuance on Windows CA
Required: SecurityEvent.
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID in (4886,4887,4888)
| extend RawEvent=tostring(EventData)
| project TimeGenerated, Computer, EventID, Account, RawEvent
| order by TimeGenerated descA05 — PKINIT-associated Kerberos pre-authentication
Required: SecurityEvent.
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4768
| extend PreAuth=tostring(column_ifexists('PreAuthType',''))
| where PreAuth in ('15','16','17')
| project TimeGenerated, Computer, Account, TargetUserName, IpAddress, PreAuth, Status
| order by TimeGenerated descA06 — Directory replication privilege usage (DCSync candidates)
Required: SecurityEvent.
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4662
| extend Raw=tostring(EventData)
| where Raw has_any ('1131f6aa','1131f6ad','89e95b76')
| project TimeGenerated, Computer, Account, SubjectUserName, Raw
| order by TimeGenerated descA07 — Renamed file-transfer utility or SFTP bulk copy
Required: DeviceProcessEvents.
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine has_any ('sftp:','--transfers','--max-age','--exclude')
| where ProcessCommandLine has_any ('copy','sync','rclone','sftp','--transfers')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessVersionInfoOriginalFileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated descA08 — Endpoint external SFTP from unusual executables
Required: DeviceNetworkEvents.
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemotePort == 22 and ActionType == 'ConnectionSuccess'
| where isnotempty(RemoteIP) and not(ipv4_is_private(RemoteIP))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, RemoteIP, RemotePort
| order by TimeGenerated descA09 — Rare privileged Windows logons from new source IPs
Required: SecurityEvent.
let Baseline = SecurityEvent
| where TimeGenerated between (ago(30d) .. ago(2d))
| where EventID == 4624 and LogonType in (3,10)
| summarize by Account, IpAddress;
SecurityEvent
| where TimeGenerated >= ago(2d)
| where EventID == 4624 and LogonType in (3,10) and isnotempty(IpAddress) and IpAddress != '-'
| join kind=leftanti Baseline on Account, IpAddress
| project TimeGenerated, Computer, Account, IpAddress, LogonType, AuthenticationPackageName
| order by TimeGenerated descDetection Notes
Highest signal: A01 for actual Defender for Identity detections, A02 for correlated remote-help-to-runtime execution, A04+A05 for CA issuance/PKINIT, and A06 for replication abuse. A07/A08 are generic exfil candidates. SecurityEvent 4886/4887 requires CA auditing; 4662 requires appropriate SACLs; Defender alert names vary by product. Defender endpoint DeviceProcessEvents and DeviceNetworkEvents are not interchangeable with Windows SecurityEvent. External Teams messages are not reliably represented in these tables. Absence of hits cannot rule out certificate abuse or unaudited CA activity.
Scope: conclusions are limited to Sentinel-ingested data and retention. No customer-specific finding is asserted.
