Threat hunts for Teams
2 hunts covering Teams, each with a hypothesis, the queries that test it and what the hunt cannot see.
2 hunts
-
criticalResearch by Huntress
ConnectWise M365 Application Abuse
An adversary has exploited compromised ConnectWise (SkyKick) vendor credentials to access M365 tenants, escalate directory privileges, and persist by adding secrets to secondary applications.
4 query2 analytic1 checkpoint1 action2 taskcredential access · initial access · persistence -
highResearch by Microsoft
IT Support Impersonation and WinRM Lateral Expansion
An adversary has hijacked a remote-support session to execute PowerShell, use a portable Node.js runtime for C2, and expand laterally via WinRM to domain controllers.
5 query2 analytic1 checkpoint1 action2 taskcommand and control · discovery · execution