{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Threat actors are bypassing email security by using trusted collaboration platforms to bridge into interactive endpoint access. A negative result validates current external collaboration controls and user awareness." }, "name": "IT Support Impersonation and Remote Access", "type": "investigation", "labels": [ "hunt", "attack.t1566.003", "attack.t1059.001", "attack.t1071", "attack.t1218.011" ], "series": { "slug": "impersonating-it-support-how-threat-actors-turn-a-remote-session-into-enterprise-wide-access", "index": 1, "title": "Impersonating IT support: how threat actors turn a remote session into enterprise-wide access", "total": 2 }, "related": [ { "hunt": "nodejs-implant-persistence", "reason": "Once an interactive session is established, attackers deploy a Node.js implant for persistence; that behavior is out of scope here.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A static rule for RMM tools triggers too many false positives. This hunt uses external collaboration as a lead and applies a prevalence baseline across the estate to find the specific tool instance an attacker selected, which a single rule cannot do.", "coverage": [ { "stage": "initial-access-teams-vishing", "steps": [ "teams-external-auth", "rare-rmm-execution", "rmm-shell-spawns" ], "status": "covered" }, { "stage": "remote-session-msi-delivery", "reason": "Belongs to the follow-on hunt focusing on MSI loaders and Node.js execution.", "status": "out_of_scope" }, { "stage": "nodejs-implant-persistence", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" }, { "stage": "c2-recon-and-tasking", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-winrm", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" }, { "stage": "execution-rundll32-dlls", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "IT Support Impersonation via Teams", "slug": "initial-access-teams-vishing", "tactic": "initial-access", "techniques": [ "T1566.003" ], "observables": [ "Microsoft Teams external tenant collaboration", "Accept/Block prompts in Teams", "Quick Assist connection code usage", "Lures: 'Microsoft Security Update', 'Spam Filter Update', 'Account Verification'", "Vishing (voice phishing) used to layer trust" ] }, { "name": "Remote Session and MSI Delivery", "slug": "remote-session-msi-delivery", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "Quick Assist or remote support tool process tree", "PowerShell downloading MSI from cloud storage", "msiexec.exe /qn (silent installation)", "MSI filenames: 'devfix.msi', 'Hotfix.msi'" ] }, { "name": "Node.js Implant Staging and Persistence", "slug": "nodejs-implant-persistence", "tactic": "persistence", "techniques": [ "T1059.001" ], "observables": [ "Portable Node.js runtime downloaded from official distribution", "Files staged in LocalAppData randomly named directories", "Nonstandard file extensions: .tmp, .ini, .dat, .bin, .cfg", "HKCU Run key 'EdgeUpdate'", "Startup folder shortcut 'EdgeUpdate.lnk'", "Renamed Node.js binaries with original metadata 'node.exe'" ] }, { "name": "C2 Communication and Reconnaissance", "slug": "c2-recon-and-tasking", "tactic": "command-and-control", "techniques": [ "T1071", "T1041", "T1555" ], "observables": [ "Randomized HTTPS long-polling to C2 server", "Discovery of antivirus products and virtualization", "ADSI (Active Directory Service Interfaces) queries", "Screen captures encoded in Base64 and saved to temporary files", "Host hardware and locale enumeration" ] }, { "name": "Lateral Movement via WinRM", "slug": "lateral-movement-winrm", "tactic": "lateral-movement", "techniques": [ "T1059.001" ], "observables": [ "WinRM connections over TCP port 5985", "Pivoting toward Domain Controllers and Certificate Authorities", "Native Windows Remote Management execution" ] }, { "name": "Follow-on Payload Execution", "slug": "execution-rundll32-dlls", "tactic": "defense-evasion", "techniques": [ "T1218.011" ], "observables": [ "rundll32.exe loading threat actor-supplied DLLs", "Short-lived cmd.exe and PowerShell child processes of Node.js" ] } ], "summary": "A human-operated campaign impersonates IT support via Microsoft Teams to trick users into granting remote access through tools like Quick Assist. Once access is established, the attackers deploy a persistent Node.js-based implant to perform extensive reconnaissance and move laterally via WinRM toward high-value infrastructure like domain controllers." }, "severity": "high", "rationale": "Start with successful external Teams authentications (hb_auth_signin). Focus on users who do not normally collaborate with external technical tenants. Use identified hostnames to narrow the rmm_processes search.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has gained interactive access by impersonating IT support via Microsoft Teams, coaxing a user into initiating an RMM session that bypasses standard perimeter controls.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-pivoting", "kind": "manual", "observed": "2024-01-01" }, "type": "list[host]", "default": [], "description": "List of hostnames to narrow the search; empty searches the whole estate." }, "lookback_days": { "from": { "ref": "standard-lookback", "kind": "manual", "observed": "2024-01-01" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "rmm_processes": { "from": { "ref": "msrc-blog", "kind": "article", "observed": "2026-09-02" }, "type": "list[string]", "default": [ "quickassist.exe", "remotehelp.exe", "anydesk.exe", "teamviewer.exe", "connectwise.exe", "screenconnect.exe", "logmein.exe", "aeroadmin.exe" ], "description": "Legitimate remote management tool process names to monitor." }, "shell_processes": { "from": { "ref": "general-threat-intelligence", "kind": "manual", "observed": "2024-01-01" }, "type": "list[string]", "default": [ "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe" ], "description": "Interpreters used by attackers for hands-on activity." }, "internal_domains": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2024-01-01" }, "type": "list[domain]", "default": [ "example.com" ], "description": "The organization's own domains; used to exclude internal collaboration from scoping." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/", "name": "Microsoft Threat Intelligence \u2014 Impersonating IT support: how threat actors turn a remote session into enterprise-wide access" } ], "blind_spots": [ { "id": "vishing-audio-blindspot", "risk": "Lures delivered through voice leave no text-based log of the impersonation attempt, making the initial link to the RMM session harder to prove.", "owner": "Collaboration Engineering", "stage": "initial-access-teams-vishing", "question": "whether the lure was delivered entirely via voice rather than chat", "requires": "Teams voice call recording or transcripts", "remediation": "Enable recording for external tenant calls if corporate policy allows, or rely on user reporting." }, { "id": "ephemeral-rmm-session", "risk": "A process that starts and fails to connect may look identical to a successful session in process logs; network telemetry confirms if hands-on activity actually occurred.", "owner": "Network Engineering", "question": "whether an RMM tool successfully contacted a controller", "requires": "hb_network_connection with process mapping", "remediation": "Ensure egress logs for RMM ports are retained and correctly attributed to process owners." } ] }, "name": "IT Support Impersonation and Remote Access", "description": "This hunt identifies the early stages of a social engineering campaign where threat actors abuse Microsoft Teams external collaboration to impersonate helpdesk personnel. The attack relies on the user voluntarily granting remote access through tools like Quick Assist or AnyDesk. The hunt begins by identifying anomalous external authentication events in Teams, then forks to identify rare RMM tool usage across the fleet and behavioral leads such as shells spawning directly from those support tools. An agent weighs the timing and prevalence of these events per host to identify the human-interactive bridge before persistent implants are deployed." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "impersonating-it-support-how-threat-actors-turn-a-remote-session-into-enterprise-wide-access", "index": 1, "title": "Impersonating IT support: how threat actors turn a remote session into enterprise-wide access", "total": 2 }, "coverage": [ { "stage": "initial-access-teams-vishing", "steps": [ "teams-external-auth", "rare-rmm-execution", "rmm-shell-spawns" ], "status": "covered" }, { "stage": "remote-session-msi-delivery", "reason": "Belongs to the follow-on hunt focusing on MSI loaders and Node.js execution.", "status": "out_of_scope" }, { "stage": "nodejs-implant-persistence", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" }, { "stage": "c2-recon-and-tasking", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-winrm", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" }, { "stage": "execution-rundll32-dlls", "reason": "Belongs to another part of the 'Impersonating IT support: how threat actors turn a remote session into enterprise-wide access' series.", "status": "out_of_scope" } ], "rationale": "An attacker has gained interactive access by impersonating IT support via Microsoft Teams, coaxing a user into initiating an RMM session that bypasses standard perimeter controls.", "blind_spots": [ { "id": "vishing-audio-blindspot", "risk": "Lures delivered through voice leave no text-based log of the impersonation attempt, making the initial link to the RMM session harder to prove.", "owner": "Collaboration Engineering", "stage": "initial-access-teams-vishing", "question": "whether the lure was delivered entirely via voice rather than chat", "requires": "Teams voice call recording or transcripts", "remediation": "Enable recording for external tenant calls if corporate policy allows, or rely on user reporting." }, { "id": "ephemeral-rmm-session", "risk": "A process that starts and fails to connect may look identical to a successful session in process logs; network telemetry confirms if hands-on activity actually occurred.", "owner": "Network Engineering", "question": "whether an RMM tool successfully contacted a controller", "requires": "hb_network_connection with process mapping", "remediation": "Ensure egress logs for RMM ports are retained and correctly attributed to process owners." } ], "scoping_notes": "Start with successful external Teams authentications (hb_auth_signin). Focus on users who do not normally collaborate with external technical tenants. Use identified hostnames to narrow the rmm_processes search.", "beyond_detection": "A static rule for RMM tools triggers too many false positives. This hunt uses external collaboration as a lead and applies a prevalence baseline across the estate to find the specific tool instance an attacker selected, which a single rule cannot do." } }, { "id": "teams-external-auth", "type": "query", "label": "External Teams authentication leads", "config": { "dsl": "sqlite", "role": "scoping", "source": "identity", "content": "SELECT actor_user_name, actor_user_domain, src_endpoint_ip, dst_endpoint_name, time FROM hb_auth_signin WHERE provider = 'm365' AND status_id = 1 AND (LOWER(dst_endpoint_name) LIKE '%teams%' OR LOWER(activity_name) LIKE '%teams%') AND NOT instr(',' || '{{internal_domains}}' || ',', ',' || LOWER(actor_user_domain) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Identify successful sign-ins to Microsoft Teams from external domains which may indicate the point of first contact from an impersonator.", "expected_signal": "Auth events from external domains. While many are legitimate guests, an event followed by RMM activity for that same user profile is a high-fidelity lead." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "External Teams authentication leads", "reads": [ "actor_user_name", "actor_user_domain", "src_endpoint_ip", "dst_endpoint_name", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT actor_user_name, actor_user_domain, src_endpoint_ip, dst_endpoint_name, time FROM hb_auth_signin WHERE provider = 'm365' AND status_id = 1 AND (LOWER(dst_endpoint_name) LIKE '%teams%' OR LOWER(activity_name) LIKE '%teams%') AND NOT instr(',' || '{{internal_domains}}' || ',', ',' || LOWER(actor_user_domain) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Auth events from external domains. While many are legitimate guests, an event followed by RMM activity for that same user profile is a high-fidelity lead.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "rare-rmm-execution", "type": "query", "label": "Rare RMM tool execution", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_name) AS rmm_tool, COUNT(DISTINCT device_hostname) AS host_count, GROUP_CONCAT(DISTINCT device_hostname) AS hosts FROM hb_process_activity WHERE instr(',' || '{{rmm_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING host_count <= 5 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Stack-count RMM tools to find specific instances that are anomalous for the environment or scoped hosts.", "expected_signal": "Rare RMM tools. Common corporate support tools will show many hosts; attacker-favored tools like Quick Assist on non-standard hosts will stand out." }, "parents": [ { "id": "teams-external-auth" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare RMM tool execution", "reads": [ "process_name", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_name) AS rmm_tool, COUNT(DISTINCT device_hostname) AS host_count, GROUP_CONCAT(DISTINCT device_hostname) AS hosts FROM hb_process_activity WHERE instr(',' || '{{rmm_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_name) HAVING host_count <= 5 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare RMM tools. Common corporate support tools will show many hosts; attacker-favored tools like Quick Assist on non-standard hosts will stand out.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name" ], "rare_below": 5 }, "verified_at": "2026-09-24" } }, { "id": "rmm-shell-spawns", "type": "query", "label": "Shell spawns from RMM tools", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND instr(',' || '{{rmm_processes}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify administrative shells originating from RMM processes, signifying hands-on-keyboard activity.", "expected_signal": "Shell processes whose parent is a legitimate RMM tool. This indicates an external operator is actively running commands on the endpoint." }, "parents": [ { "id": "teams-external-auth" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Shell spawns from RMM tools", "reads": [ "device_hostname", "user_name", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND instr(',' || '{{rmm_processes}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Shell processes whose parent is a legitimate RMM tool. This indicates an external operator is actively running commands on the endpoint.", "verified": "dry-run", "verified_at": "2026-09-24" } }, { "id": "triage-agent", "type": "analytic", "label": "Triage session evidence", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "teams-external-auth", "rare-rmm-execution", "rmm-shell-spawns" ], "objective": "Determine if any host shows a sequence of external Teams authentication followed by the execution of a rare RMM tool and subsequent shell activity within the same hour. Cite specific rows for all three steps.", "description": "Correlate external auth leads with rare RMM usage and shell spawns to identify malicious interactive bridges.", "max_iterations": 6, "expected_signal": "A per-host verdict that links the Teams lure to the interactive session.", "success_criteria": "A per-host verdict of malicious | suspicious | benign with cited times and command lines." }, "parents": [ { "id": "rare-rmm-execution", "kind": "merge" }, { "id": "rmm-shell-spawns", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host based on the auth-to-RMM-to-shell chain", "condition": "the triage verdict is malicious for at least one host based on the auth-to-RMM-to-shell chain", "blind_spot": "vishing-audio-blindspot", "confidence": "high", "description": "Decide whether to isolate the host based on the risk of an active interactive session.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Terminate the threat actor's interactive access by isolating the endpoint from the network.", "instructions": "Isolate the host immediately. Revoke the user's M365/Teams session to prevent further external chat interaction.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "review-teams-logs", "type": "task", "label": "Review Teams chat and lure logs", "config": { "assignee": "analyst", "description": "Confirm the social engineering pretext through manual inspection of the collaboration record.", "instructions": "Examine Teams chat logs for messages from the identified external domain. Look for requests to run Quick Assist or instructions to read back codes. If vishing is suspected, interview the user to confirm if they received a voice call alongside the chat." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "hunt-close-out", "type": "task", "label": "Hunt summary and close-out", "config": { "assignee": "analyst", "description": "Document findings and update the RMM monitoring baseline.", "instructions": "Record the outcome. If a new RMM tool was used, update the rmm_processes parameter for future runs. Report any lack of Teams external-call logging to the platform team." }, "parents": [ { "id": "review-teams-logs" } ] } ] }