{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Social engineering via Teams bypasses email-based security. A user-approved remote session provides a high-privilege foothold; detecting the transition to runtime execution stops the attack before it targets identity infrastructure." }, "name": "Teams Impersonation and Portable Runtime Execution", "type": "investigation", "labels": [ "hunt", "attack.t1566.003", "attack.t1566.004", "attack.t1219", "attack.t1036", "attack.t1059.003", "attack.t1059.007", "attack.t1016", "attack.t1057", "attack.t1082", "credential access", "discovery", "execution", "exfiltration", "initial access" ], "series": { "slug": "from-help-desk-impersonation-to-ad-cs-abuse-investigating-esc1-and-esc8-intrusion-paths", "index": 1, "title": "From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths", "total": 2 }, "related": [ { "hunt": "ad-cs-certificate-abuse-esc1-esc8", "reason": "This hunt identifies the beachhead; the next hunt examines certificate issuance and relay behavior.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "A rule might flag discovery commands, but this hunt pivots between three signals: the remote support tool launch, external authentication from a suspicious tenant, and the execution of rare runtimes from user-writable paths. An analyst weighs these to confirm an incident.", "coverage": [ { "stage": "teams-impersonation-phishing", "steps": [ "external-teams-auth" ], "status": "covered" }, { "stage": "remote-access-quick-assist", "steps": [ "scope-quick-assist" ], "status": "covered" }, { "stage": "portable-runtime-staging", "steps": [ "kb-staging-creation", "discovery-from-profile-runtimes" ], "status": "covered" }, { "stage": "host-discovery", "steps": [ "discovery-from-profile-runtimes" ], "status": "covered" }, { "stage": "ad-cs-assessment", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "ad-cs-certificate-abuse", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "data-exfiltration", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Teams Helpdesk Impersonation", "slug": "teams-impersonation-phishing", "tactic": "initial-access", "techniques": [ "T1566.003", "T1566.004" ], "observables": [ "onmicrosoft.com tenant names", "support-oriented display names", "Microsoft Teams messages and calls" ] }, { "name": "Remote Support Hijack", "slug": "remote-access-quick-assist", "tactic": "execution", "techniques": [ "T1219" ], "observables": [ "QuickAssist.exe", "user-approved remote session" ] }, { "name": "Portable Runtime Staging", "slug": "portable-runtime-staging", "tactic": "execution", "techniques": [ "T1036", "T1059.003", "T1059.007" ], "observables": [ "KB-prefixed directory in user profile", "archive in Downloads folder", "renamed Bun executable", "portable Python runtime", "portable Java runtime" ] }, { "name": "Host and Network Discovery", "slug": "host-discovery", "tactic": "discovery", "techniques": [ "T1016", "T1057", "T1082" ], "observables": [ "ipconfig /all", "tasklist", "Windows version registry query" ] }, { "name": "AD CS Vulnerability Assessment", "slug": "ad-cs-assessment", "tactic": "discovery", "techniques": [ "T1082" ], "observables": [ "LDAPS connections to domain infrastructure", "SMB connections to domain infrastructure" ] }, { "name": "AD CS Privilege Escalation (ESC1/ESC8)", "slug": "ad-cs-certificate-abuse", "tactic": "credential-access", "techniques": [ "T1649", "T1557", "T1190" ], "observables": [ "ESC1 vulnerable template abuse", "PetitPotam NTLM relay", "Relay to AD CS Web Enrollment (ESC8)", "PKINIT certificate-based Kerberos authentication" ] }, { "name": "Privileged Data Exfiltration", "slug": "data-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041", "T1567.002" ], "observables": [ "Exfiltration via privileged identity excluded from containment" ] } ], "summary": "Threat actors use Microsoft Teams to impersonate help desk staff and persuade users to grant remote access via Quick Assist. From this foothold, they execute scripts via portable runtimes to discover and abuse AD CS configurations, specifically ESC1 and ESC8, to escalate privileges and obtain persistent domain access." }, "severity": "high", "rationale": "Prioritize identifying any host that ran Quick Assist in the last 14 days. Filter on users who have not recently opened official support tickets.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has impersonated help desk staff via Microsoft Teams to establish a remote support session and execute portable runtimes from a user-writable directory to begin system discovery.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Hostnames to narrow the hunt, typically populated from the early access triage." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "runtime_hashes": { "from": { "ref": "msrc-blog-2026-10-30", "kind": "article", "observed": "2026-10-30" }, "type": "list[hash]", "default": [ "85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17", "f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001", "06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7" ], "description": "Known hashes for portable runtimes observed in the report." }, "staging_pattern": { "from": { "ref": "msrc-blog-2026-10-30", "kind": "article", "observed": "2026-10-30" }, "type": "string", "default": "KB%", "description": "SQL LIKE pattern for the attacker staging directory under user profiles." }, "discovery_commands": { "from": { "ref": "msrc-blog-2026-10-30", "kind": "article", "observed": "2026-10-30" }, "type": "list[string]", "default": [ "ipconfig.exe", "tasklist.exe", "systeminfo.exe", "net.exe", "whoami.exe" ], "description": "System discovery utilities (original filenames) used by the intruder." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/", "name": "MSRC \u2014 From help desk impersonation to AD CS abuse" } ], "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A user on a non-enrolled device could grant access that later pivots into the domain via identity infrastructure.", "question": "Whether Quick Assist was launched on unmanaged devices.", "requires": "an endpoint agent on every host in scope" }, { "id": "teams-message-content", "risk": "The hunt relies on authentication patterns because direct social engineering content is not in endpoint telemetry.", "stage": "teams-impersonation-phishing", "question": "What specifically was said in the Teams message.", "requires": "Microsoft Teams audit log" } ] }, "name": "Teams Impersonation and Portable Runtime Execution", "description": "This hunt identifies the transition from external social engineering to hands-on-keyboard access. It follows a phased approach: first, it identifies hosts with recent Quick Assist activity or cross-tenant Teams authentications. Second, it pivots to those hosts to find portable runtimes (Python, Bun, or Java) launched from user-profile staging directories that then execute system discovery commands. This behavior-based approach detects the execution environment and session context rather than relying solely on file indicators." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "from-help-desk-impersonation-to-ad-cs-abuse-investigating-esc1-and-esc8-intrusion-paths", "index": 1, "title": "From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths", "total": 2 }, "coverage": [ { "stage": "teams-impersonation-phishing", "steps": [ "external-teams-auth" ], "status": "covered" }, { "stage": "remote-access-quick-assist", "steps": [ "scope-quick-assist" ], "status": "covered" }, { "stage": "portable-runtime-staging", "steps": [ "kb-staging-creation", "discovery-from-profile-runtimes" ], "status": "covered" }, { "stage": "host-discovery", "steps": [ "discovery-from-profile-runtimes" ], "status": "covered" }, { "stage": "ad-cs-assessment", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "ad-cs-certificate-abuse", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" }, { "stage": "data-exfiltration", "reason": "Belongs to another part of the 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths' series.", "status": "out_of_scope" } ], "rationale": "An intruder has impersonated help desk staff via Microsoft Teams to establish a remote support session and execute portable runtimes from a user-writable directory to begin system discovery.", "blind_spots": [ { "id": "missing-endpoint-telemetry", "risk": "A user on a non-enrolled device could grant access that later pivots into the domain via identity infrastructure.", "question": "Whether Quick Assist was launched on unmanaged devices.", "requires": "an endpoint agent on every host in scope" }, { "id": "teams-message-content", "risk": "The hunt relies on authentication patterns because direct social engineering content is not in endpoint telemetry.", "stage": "teams-impersonation-phishing", "question": "What specifically was said in the Teams message.", "requires": "Microsoft Teams audit log" } ], "scoping_notes": "Prioritize identifying any host that ran Quick Assist in the last 14 days. Filter on users who have not recently opened official support tickets.", "beyond_detection": "A rule might flag discovery commands, but this hunt pivots between three signals: the remote support tool launch, external authentication from a suspicious tenant, and the execution of rare runtimes from user-writable paths. An analyst weighs these to confirm an incident." } }, { "id": "scope-quick-assist", "type": "query", "label": "Scope hosts using Quick Assist", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, user_name, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_process_activity WHERE LOWER(process_name) LIKE '%\\\\quickassist.exe' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, user_name", "surface": "hb_process_activity", "description": "Identify hosts that have recently run Quick Assist, the primary vector for hands-on-keyboard access in this campaign.", "expected_signal": "Hosts where Quick Assist was launched. None means no Quick Assist sessions occurred on managed hosts in this window." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope hosts using Quick Assist", "reads": [ "device_hostname", "user_name", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, user_name, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_process_activity WHERE LOWER(process_name) LIKE '%\\\\quickassist.exe' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, user_name", "silence": "not_evidence_of_absence", "expected": "Hosts where Quick Assist was launched. None means no Quick Assist sessions occurred on managed hosts in this window.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "external-teams-auth", "type": "query", "label": "Teams authentication from external tenants", "config": { "dsl": "sqlite", "role": "enrichment", "source": "identity", "content": "SELECT device_hostname, actor_user_name, home_tenant_id, resource_tenant_id, time FROM hb_auth_signin WHERE provider = 'm365' AND home_tenant_id != resource_tenant_id AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Find users authenticating via Teams where the home tenant does not match the resource tenant, indicating cross-tenant contact.", "expected_signal": "A sign-in from an external tenant. This identifies the social engineering contact point." }, "parents": [ { "id": "scope-quick-assist" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Teams authentication from external tenants", "reads": [ "device_hostname", "actor_user_name", "home_tenant_id", "resource_tenant_id", "time" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT device_hostname, actor_user_name, home_tenant_id, resource_tenant_id, time FROM hb_auth_signin WHERE provider = 'm365' AND home_tenant_id != resource_tenant_id AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A sign-in from an external tenant. This identifies the social engineering contact point.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "kb-staging-creation", "type": "query", "label": "KB-prefixed staging directory creation", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_path, file_name, actor_user_name, time FROM hb_file_activity WHERE activity_id = 1 AND LOWER(file_path) LIKE '%\\\\users\\\\%' AND LOWER(file_name) LIKE LOWER('{{staging_pattern}}') AND file_type = 'directory' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Find the creation of the specific staging directories used to host portable runtimes under user profiles.", "expected_signal": "New folders created under a user profile matching the staging prefix. None means no such folders were detected." }, "parents": [ { "id": "scope-quick-assist" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "KB-prefixed staging directory creation", "reads": [ "device_hostname", "file_path", "file_name", "actor_user_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, file_name, actor_user_name, time FROM hb_file_activity WHERE activity_id = 1 AND LOWER(file_path) LIKE '%\\\\users\\\\%' AND LOWER(file_name) LIKE LOWER('{{staging_pattern}}') AND file_type = 'directory' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "New folders created under a user profile matching the staging prefix. None means no such folders were detected.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "agent-triage-access", "type": "analytic", "label": "Weigh initial access evidence", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "scope-quick-assist", "external-teams-auth", "kb-staging-creation" ], "objective": "Identify hosts where a remote session was established followed by suspicious file staging or external authentication. Provide a list of hostnames to focus the next behaviour search.", "description": "Determine if the Quick Assist usage, external Teams auth, and staging activity suggest a successful impersonation attempt.", "max_iterations": 4, "expected_signal": "Identification of hosts with evidence of social engineering and staging.", "success_criteria": "A per-host verdict of suspicious or benign, citing specific events." }, "parents": [ { "id": "external-teams-auth", "kind": "merge" }, { "id": "kb-staging-creation", "kind": "merge" } ] }, { "id": "discovery-from-profile-runtimes", "type": "query", "label": "Discovery commands from profile-path runtimes", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, process_original_file_name, process_hash_sha256, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_path) LIKE '%\\\\users\\\\%' OR LOWER(process_path) LIKE '%\\\\appdata\\\\%') AND (instr(',' || '{{discovery_commands}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR instr(',' || '{{runtime_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify discovery commands that processes in staging directories launch.", "expected_signal": "System discovery processes like ipconfig or tasklist running from a portable runtime located in a user profile." }, "parents": [ { "id": "agent-triage-access" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Discovery commands from profile-path runtimes", "reads": [ "device_hostname", "process_name", "process_cmd_line", "process_path", "process_hash_sha256", "process_original_file_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, process_original_file_name, process_hash_sha256, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_path) LIKE '%\\\\users\\\\%' OR LOWER(process_path) LIKE '%\\\\appdata\\\\%') AND (instr(',' || '{{discovery_commands}}' || ',', ',' || LOWER(process_original_file_name) || ',') > 0 OR instr(',' || '{{runtime_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "System discovery processes like ipconfig or tasklist running from a portable runtime located in a user profile.", "verified": "dry-run", "verified_at": "2026-10-31" } }, { "id": "agent-triage-behavior", "type": "analytic", "label": "Assess behavior and execution", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "agent-triage-access", "discovery-from-profile-runtimes" ], "objective": "Determine if the discovery commands originated from runtimes staged during the social engineering phase identified by the previous agent.", "description": "Final triage combining the access evidence with the observed discovery commands and runtime execution.", "max_iterations": 5, "expected_signal": "A definitive verdict on whether the host has been compromised by the impersonation campaign.", "success_criteria": "A verdict of malicious | suspicious | benign per host." }, "parents": [ { "id": "discovery-from-profile-runtimes" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the agent-triage-behavior verdict is malicious for at least one host", "condition": "the agent-triage-behavior verdict is malicious for at least one host", "blind_spot": "missing-endpoint-telemetry", "confidence": "high", "description": "Determine the response path based on the behavior triage.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "agent-triage-behavior" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent further lateral movement or certificate abuse by isolating the affected workstation.", "instructions": "Isolate the host and revoke any active Teams sessions for the user. Collect the binary and scripts found in the KB-prefixed directory for analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-investigation", "type": "task", "label": "Analyst Investigation", "config": { "assignee": "analyst", "description": "Manual inspection of the execution chain and discovery commands.", "instructions": "Examine the file creation events in the identified KB-prefixed directory. Verify if scripts were executed. Pivot to hb_network_connection to see if LDAPS or SMB connections were made to domain controllers." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Close Out Hunt", "config": { "assignee": "analyst", "description": "Finalize the hunt and document findings.", "instructions": "If results were benign, document Quick Assist usage. If suspicious, ensure escalation for AD CS abuse investigation." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" } ] } ] }