Microsoft Details Cross-Tenant Helpdesk Impersonation Intrusion Chain

Summary

Microsoft describes a human-operated intrusion chain using cross-tenant Teams helpdesk impersonation to gain Quick Assist access, sideload payloads, pivot with WinRM and exfiltrate data via Rclone. It also provides hunting queries and defenses.

Key points

Microsoft describes attackers impersonating IT help desks through cross-tenant Teams chats or calls, sometimes with vishing, to persuade users to launch Quick Assist and approve elevation prompts.
The described activity includes rapid reconnaissance, often within 30–120 seconds of remote access, using cmd.exe or PowerShell to check user privileges, system details and domain affiliation.
Attackers stage payloads in user-writable locations and use DLL side-loading through trusted signed applications; encoded configuration stored in the user registry is decrypted in memory.
Microsoft reports sideloaded processes communicating over HTTPS, followed by credential-backed WinRM movement toward high-value systems such as domain controllers and installation of additional management tooling.
The described actors use Rclone to transfer targeted business data to cloud storage, with file-type exclusions intended to reduce transfer size and detection risk.
The article provides hunting queries to correlate Teams activity with remote-management launches, reconnaissance, staging, registry changes, network connections and Rclone activity.
Recommended defenses include user education, Conditional Access and MFA, restricting remote-management tools and WinRM, and enabling Safe Links, ZAP, ASR and WDAC.

Article Details

Attack Vectors: Attackers impersonate IT or helpdesk personnel in cross-tenant Microsoft Teams chats or calls, sometimes using vishing, to persuade users to launch Quick Assist and approve access or elevation prompts.
After obtaining interactive access, attackers conduct rapid reconnaissance using cmd.exe or PowerShell to inspect user, system, domain, and network information.
Attackers stage payloads in locations such as ProgramData and use trusted signed applications to DLL side-load attacker-supplied modules.
A sideloaded component stores encoded or encrypted configuration in user-context registry locations and decrypts it in memory.
Compromised processes establish HTTPS command-and-control communications with externally hosted infrastructure.
Attackers use WinRM for credential-backed lateral movement toward domain-joined systems, including domain controllers.
Attackers install auxiliary remote management software using msiexec.exe and use Rclone to transfer selected business data to external cloud storage.
Defensive Notes: Enforce Conditional Access and MFA for administrative roles, and require compliant devices where appropriate.
Restrict WinRM and remote management tools to authorized roles and management workstations.
Enable Safe Links for Teams and ensure Zero-hour Auto Purge (ZAP) is active.
Use Attack Surface Reduction rules and Windows Defender Application Control to restrict DLL side-loading and execution from user-writable locations.
Enable network protection and investigate suspicious outbound connections, registry modifications, and use of Rclone or similar synchronization utilities.
Train employees to verify external tenant indicators and treat unsolicited helpdesk contact as suspicious; consider an internal verbal authentication phrase.