CasesCASE-007

SOC investigation

Teams Helpdesk Impersonation Leads to Remote Access

An external Teams helpdesk persona convinced a user to launch Quick Assist, leading to shell execution, WinRM lateral movement, alternate RMM, and Rclone exfiltration.

Based on publicly reported attack activity. User identities and workstation names have been anonymized.

Initial alert: Remote management activity after suspicious Microsoft Teams IT-support contact
Severity: Critical

Case story

What happened

The investigation begins with a collaboration-to-endpoint sequence: suspicious external Teams contact, remote-assistance launch, and near-immediate command execution.

Initial contact
External Teams account impersonates IT support
A cross-tenant sender initiates Teams contact using a support/security pretext and asks the user to accept remote help.
Remote foothold
User launches Quick Assist and grants control
The user follows the attacker's instructions, enters the assistance key, and approves the standard prompts.
First minutes
Shells and rapid reconnaissance appear
cmd.exe or PowerShell activity follows the remote-assistance session and the actor validates identity, access, and environment details.
Execution / C2
Trusted applications host attacker-controlled code
Vendor-signed applications are invoked with attacker-supplied modules and the resulting implant communicates externally.
Lateral movement
WinRM pivots toward high-value systems
The compromised endpoint initiates remote management traffic over TCP 5985 toward additional domain-joined systems.
Persistence / exfiltration
Alternate RMM and Rclone extend access and remove data
Additional RMM software is installed and Rclone transfers selected business data to external cloud storage.

Investigation

What was checked

Follow how the analyst tested and revised explanations. This is discovery order, not event chronology.

01
Confirm the collaboration lure
The collaboration event anchors the social-engineering phase and identifies the sender/time window.
Next pivot
Check the endpoint for Quick Assist immediately after the Teams contact.
View query
Q-01
Recover suspicious external Teams support contact
What this checks
Identify Teams messages from an external sender using an IT/helpdesk-style display name and targeting denis@example.com before the endpoint activity.
KQL
let target_user_object_id = "<USER_OBJECT_ID>"; let organization_domains = dynamic(["example.com"]); MessageEvents | where Timestamp >= ago(7d) | extend Recipient=parse_json(RecipientDetails) | mv-expand Recipient | extend VictimAccountObjectId=tostring(Recipient.RecipientObjectId), VictimRecipientDisplayName=tostring(Recipient.RecipientDisplayName), SenderDomain=tolower(extract(@"@([^>]+)$", 1, SenderEmailAddress)) | where VictimAccountObjectId == target_user_object_id | where isnotempty(SenderDomain) and SenderDomain !in~ (organization_domains) | where SenderDisplayName has_any ( "helpdesk", "help desk", "it support", "microsoft support", "security", "service desk" ) | project Timestamp, SenderEmailAddress, SenderDisplayName, SenderDomain, VictimRecipientDisplayName, VictimAccountObjectId, ThreatTypes, DeliveryAction, NetworkMessageId | order by Timestamp asc
SPL
index=<teams_message_index> sourcetype=<defender_messageevents_sourcetype> earliest=-7d | eval sender=lower(coalesce(sender,SenderEmailAddress)), sender_display=lower(coalesce(sender_display,SenderDisplayName)), sender_domain=lower(replace(sender,"^.*@","")), recipient_object_id=coalesce(recipient_object_id,RecipientObjectId), message_id=coalesce(message_id,NetworkMessageId) | where recipient_object_id="<USER_OBJECT_ID>" AND sender_domain!="example.com" AND ( like(sender_display,"%helpdesk%") OR like(sender_display,"%help desk%") OR like(sender_display,"%it support%") OR like(sender_display,"%microsoft support%") OR like(sender_display,"%security%") OR like(sender_display,"%service desk%") ) | fields _time sender sender_display sender_domain recipient_object_id ThreatTypes DeliveryAction message_id | sort 0 _time
What to look for
A helpdesk/security-themed external sender targeting the affected user in the relevant timeframe.
Technical details
Tested signal
External collaboration message using support/security/helpdesk pretext shortly before remote-assistance activity.
Assumptions
MessageEvents contains Teams message sender and RecipientDetails data.
The local tenant domains are known and can be excluded explicitly.
Data requirements and relevant fields
saas audit
Microsoft Defender XDR MessageEvents representing Microsoft Teams collaboration events with sender and recipient identity context.
Timestamp
SenderEmailAddress
SenderDisplayName
RecipientDetails
NetworkMessageId
ThreatTypes
DeliveryAction
KQL schema
Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.
SPL schema
Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.
Limitations
Legitimate vendors and outsourced support can contact users from external tenants.
Display-name keywords are only a triage aid; the external sender/tenant context and subsequent endpoint behavior matter more.
KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.
More reasoning
Observation
The user reports an unsolicited Teams support interaction shortly before compromise.
Working explanation
An external actor may have impersonated internal IT/helpdesk staff to initiate the remote-access workflow.
What was checked
Review Teams MessageEvents for external support-themed senders targeting the affected identity.
Interpretation
External collaboration alone is not malicious; the remote-access transition is the decisive next signal.
Supporting evidence
E-01

Next pivot

Inspect the first two minutes of process activity for reconnaissance.

View query

What this checks

Determine whether the affected user launched Quick Assist and then produced cmd.exe or PowerShell activity within minutes.

KQL

let target_user_object_id="<USER_OBJECT_ID>";
let quickassist =
    DeviceProcessEvents
    | where Timestamp >= ago(7d)
    | where FileName =~ "QuickAssist.exe"
    | where AccountObjectId == target_user_object_id
    | project
        QATime=Timestamp,
        DeviceId,
        DeviceName,
        AccountUpn,
        AccountObjectId,
        QACommandLine=ProcessCommandLine,
        QAProcessId=ProcessId,
        QAProcessUniqueId=ProcessUniqueId;
let shells =
    DeviceProcessEvents
    | where Timestamp >= ago(7d)
    | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe")
    | where AccountObjectId == target_user_object_id
    | project
        ShellTime=Timestamp,
        DeviceId,
        AccountObjectId,
        ShellName=FileName,
        ShellCommandLine=ProcessCommandLine,
        ParentName=InitiatingProcessFileName,
        ParentCommandLine=InitiatingProcessCommandLine;
quickassist
| join kind=inner shells on DeviceId, AccountObjectId
| where ShellTime between (QATime .. QATime + 5m)
| project
    QATime,
    ShellTime,
    DeviceName,
    AccountUpn,
    QACommandLine,
    ShellName,
    ShellCommandLine,
    ParentName,
    ParentCommandLine
| order by QATime asc

SPL

index=<endpoint_process_index> sourcetype=<process_events_sourcetype>
earliest=-7d
| eval
    user_object_id=coalesce(user_object_id,AccountObjectId),
    device=coalesce(device,DeviceName,host),
    process_name=lower(coalesce(process_name,FileName)),
    process_command_line=coalesce(process_command_line,ProcessCommandLine),
    parent_process_name=lower(coalesce(parent_process_name,InitiatingProcessFileName)),
    parent_command_line=coalesce(parent_command_line,InitiatingProcessCommandLine),
    event_type=case(
        process_name="quickassist.exe","quickassist",
        process_name IN ("cmd.exe","powershell.exe","pwsh.exe"),"shell",
        true(),"other"
    )
| where user_object_id="<USER_OBJECT_ID>" AND event_type!="other"
| sort 0 device user_object_id _time
| streamstats current=f
    last(eval(if(event_type="quickassist",_time,null()))) as qa_time
    by device user_object_id
| where event_type="shell" AND isnotnull(qa_time) AND _time>=qa_time AND _time<=qa_time+300
| table _time qa_time device user_object_id process_name process_command_line parent_process_name parent_command_line
| sort 0 qa_time

What to look for

A Quick Assist session followed by shell execution in the same user context, matching Microsoft's stated high-value signal.

Technical details

Tested signal

QuickAssist.exe followed by command shell or PowerShell on the same device/user in a tight window.

Assumptions

DeviceProcessEvents retains AccountObjectId and process creation timestamps.
The affected user object ID is known from the Teams pivot.

Data requirements and relevant fields

process: Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.
Timestamp
DeviceId
DeviceName
FileName
FolderPath
ProcessId
ProcessUniqueId
ProcessCommandLine
ProcessVersionInfoOriginalFileName
AccountUpn
AccountObjectId
AccountName
SHA1
SHA256
InitiatingProcessFileName
InitiatingProcessCommandLine
InitiatingProcessId
InitiatingProcessUniqueId
InitiatingProcessAccountUpn
InitiatingProcessAccountObjectId

KQL schema

Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.

SPL schema

Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.

Limitations

Legitimate support engineers can use Quick Assist and then open shells during troubleshooting.
The value comes from the unexpected external support contact and compressed sequence.

KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.

More reasoning

Observation

Microsoft identifies Quick Assist followed immediately by cmd.exe or PowerShell as a strong signal in this intrusion path.

Working explanation

The external support interaction may have converted into hands-on-keyboard access.

What was checked

Correlate QuickAssist.exe with shell execution for the same user/device within five minutes.

Interpretation

Legitimate helpdesk work can use the same tools, so the external sender and subsequent behavior remain essential context.

Supporting evidence

E-02

03
Measure the first hands-on-keyboard actions
A burst of identity, host, network, service, or domain discovery supports attacker-directed control.
Next pivot
Look for trusted application invocation and attacker-controlled modules.
View query
Q-03
Inspect immediate hands-on-keyboard reconnaissance
What this checks
Recover short-window reconnaissance commands after Quick Assist to determine how the attacker validated access and the environment.
KQL
let target_device="<DEVICE_NAME>"; let quickassist_time=datetime(<QUICKASSIST_TIME_UTC>); DeviceProcessEvents | where Timestamp between (quickassist_time .. quickassist_time + 2m) | where DeviceName =~ target_device | where FileName in~ ( "cmd.exe","powershell.exe","pwsh.exe","whoami.exe","hostname.exe", "ipconfig.exe","systeminfo.exe","nltest.exe","net.exe","net1.exe", "quser.exe","query.exe","tasklist.exe","sc.exe" ) | project Timestamp, DeviceName, AccountUpn, FileName, ProcessCommandLine, FolderPath, SHA1, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp asc
SPL
index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=<qa_time> latest=<qa_plus_2m> | eval device=coalesce(device,DeviceName,host), user=lower(coalesce(user,AccountUpn)), process_name=lower(coalesce(process_name,FileName)), process_command_line=coalesce(process_command_line,ProcessCommandLine), parent_process_name=lower(coalesce(parent_process_name,InitiatingProcessFileName)), parent_command_line=coalesce(parent_command_line,InitiatingProcessCommandLine) | where device="<DEVICE_NAME>" AND process_name IN ( "cmd.exe","powershell.exe","pwsh.exe","whoami.exe","hostname.exe", "ipconfig.exe","systeminfo.exe","nltest.exe","net.exe","net1.exe", "quser.exe","query.exe","tasklist.exe","sc.exe" ) | fields _time device user process_name process_command_line parent_process_name parent_command_line SHA1 SHA256 | sort 0 _time
What to look for
Rapid user/device/domain/network discovery immediately after remote access, consistent with human-operated intrusion activity.
Technical details
Tested signal
Discovery commands executed within two minutes after the remote-assistance foothold.
Assumptions
The Quick Assist start time and device are known from Q-02.
Data requirements and relevant fields
process
Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.
Timestamp
DeviceId
DeviceName
FileName
FolderPath
ProcessId
ProcessUniqueId
ProcessCommandLine
ProcessVersionInfoOriginalFileName
AccountUpn
AccountObjectId
AccountName
SHA1
SHA256
InitiatingProcessFileName
InitiatingProcessCommandLine
InitiatingProcessId
InitiatingProcessUniqueId
InitiatingProcessAccountUpn
InitiatingProcessAccountObjectId
KQL schema
Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.
SPL schema
Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.
Limitations
Helpdesk troubleshooting can legitimately run some of the same commands.
Sequence, external-contact context, and subsequent payload/C2 behavior are required for confidence.
KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.
More reasoning
Observation
The actor typically spends 30-120 seconds validating access and environment context.
Working explanation
Rapid discovery commands may distinguish human-operated intrusion from routine remote assistance.
What was checked
Review shells and common reconnaissance utilities immediately after Quick Assist.
Interpretation
Command names are not sufficient alone; their timing and the rest of the intrusion chain matter.
Supporting evidence
E-03
04
Check trusted application abuse
Unexpected execution of the source-reported hosts provides a focused pivot into file and network behavior.
Next pivot
Scope outbound and internal network activity from the compromised process/device.
View query
Q-04
Find source-reported trusted application invocation
What this checks
Search for vendor-signed executables named in Microsoft's intrusion report and inspect their command line and parent context for side-loading behavior.
KQL
DeviceProcessEvents | where Timestamp >= ago(7d) | where FileName in~ ( "AcroServicesUpdater2_x64.exe", "ADNotificationManager.exe", "DlpUserAgent.exe" ) | project Timestamp, DeviceId, DeviceName, AccountUpn, FileName, FolderPath, ProcessCommandLine, ProcessUniqueId, SHA1, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessUniqueId | order by Timestamp asc
SPL
index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-7d | eval process_name=lower(coalesce(process_name,FileName)), device=coalesce(device,DeviceName,host), user=lower(coalesce(user,AccountUpn)), process_path=coalesce(process_path,FolderPath), process_command_line=coalesce(process_command_line,ProcessCommandLine), process_uid=coalesce(process_uid,ProcessUniqueId), parent_process_name=coalesce(parent_process_name,InitiatingProcessFileName), parent_command_line=coalesce(parent_command_line,InitiatingProcessCommandLine) | where process_name IN ( "acroservicesupdater2_x64.exe", "adnotificationmanager.exe", "dlpuseragent.exe" ) | fields _time device user process_name process_path process_command_line process_uid SHA1 SHA256 parent_process_name parent_command_line | sort 0 _time
What to look for
Execution of AcroServicesUpdater2_x64.exe, ADNotificationManager.exe, or DlpUserAgent.exe in suspicious context.
Technical details
Tested signal
Source-reported trusted application names executed from an unexpected path or context after the Quick Assist foothold.
Assumptions
The source-reported filenames are used as retrospective pivots, not as universal requirements.
Data requirements and relevant fields
process
Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.
Timestamp
DeviceId
DeviceName
FileName
FolderPath
ProcessId
ProcessUniqueId
ProcessCommandLine
ProcessVersionInfoOriginalFileName
AccountUpn
AccountObjectId
AccountName
SHA1
SHA256
InitiatingProcessFileName
InitiatingProcessCommandLine
InitiatingProcessId
InitiatingProcessUniqueId
InitiatingProcessAccountUpn
InitiatingProcessAccountObjectId
KQL schema
Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.
SPL schema
Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.
Limitations
The filenames can exist legitimately in vendor software.
A negative result does not weaken the attack hypothesis because actors can rotate signed host binaries.
KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.
More reasoning
Observation
Microsoft observed trusted vendor-signed applications being used alongside attacker-supplied modules.
Working explanation
The actor may be using DLL side-loading or another trusted-host pattern to execute the implant.
What was checked
Search the source-reported trusted application names and preserve path, command line, hashes, parent, and stable process identity.
Interpretation
These executables are not malicious by name; suspicious path/module/network context is required.
Supporting evidence
E-03
05
Scope WinRM lateral movement
WinRM targets define the lateral-movement blast radius and systems requiring immediate triage.
Next pivot
Review destination-host execution and alternate remote-management deployment.
View query
Q-05
Scope WinRM lateral movement
What this checks
Identify outbound WinRM connections from the initially compromised device toward internal systems after the remote-assistance foothold.
KQL
let target_device="<DEVICE_NAME>"; DeviceNetworkEvents | where Timestamp >= ago(7d) | where DeviceName =~ target_device | where RemotePort == 5985 | project Timestamp, DeviceId, DeviceName, LocalIP, RemoteIP, RemotePort, Protocol, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountUpn, InitiatingProcessUniqueId | order by Timestamp asc
SPL
index=<endpoint_network_index> sourcetype=<endpoint_network_events_sourcetype> earliest=-7d | eval device=coalesce(device,DeviceName,host), remote_ip=coalesce(remote_ip,RemoteIP,dest_ip), remote_port=coalesce(remote_port,RemotePort,dest_port), process_name=lower(coalesce(process_name,InitiatingProcessFileName)), process_command_line=coalesce(process_command_line,InitiatingProcessCommandLine), user=lower(coalesce(user,InitiatingProcessAccountUpn)) | where device="<DEVICE_NAME>" AND remote_port=5985 | fields _time device user process_name process_command_line remote_ip remote_port Protocol | sort 0 _time
What to look for
WinRM traffic from a user workstation toward internal servers or identity infrastructure shortly after the Quick Assist session.
Technical details
Tested signal
Connections to TCP 5985 from the compromised endpoint, initiated by WinRM or attacker-controlled shell context.
Assumptions
The compromised device is known and DeviceNetworkEvents covers internal connections.
Data requirements and relevant fields
network
Microsoft Defender for Endpoint network telemetry with destination, port, protocol, initiating process, device, and user context.
Timestamp
DeviceId
DeviceName
RemoteUrl
RemoteIP
RemotePort
Protocol
LocalIP
LocalPort
InitiatingProcessFileName
InitiatingProcessCommandLine
InitiatingProcessAccountUpn
InitiatingProcessAccountObjectId
InitiatingProcessUniqueId
KQL schema
Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.
SPL schema
Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.
Limitations
Enterprise administration can legitimately use WinRM.
Management workstations and approved automation sources should be baselined separately.
KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.
More reasoning
Observation
The compromised system initiates WinRM toward additional domain-joined hosts.
Working explanation
Stolen or validated credentials may be enabling native remote execution toward high-value assets.
What was checked
Search TCP 5985 activity from the compromised device and identify every destination and initiating process.
Interpretation
Approved WinRM administration should originate from known management hosts and identities, not an unexpected user-session foothold.
Supporting evidence
E-04
06
Confirm sustained access and exfiltration
RMM or Rclone confirms progression into persistence/exfiltration and defines containment urgency.
Next pivot
Contain all affected hosts and identities, then scope the external storage destination and transferred data.
View query
Q-06
Confirm alternate RMM deployment and Rclone exfiltration
What this checks
Search for Microsoft-observed late-stage behavior: RMM installation through Windows Installer and Rclone execution with exfiltration-oriented arguments.
KQL
DeviceProcessEvents | where Timestamp >= ago(7d) | where ( FileName =~ "msiexec.exe" and ProcessCommandLine has_any ("http://","https://",".msi") ) or ( FileName =~ "rclone.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe" ) | extend RcloneSourcePattern = FileName =~ "rclone.exe" and ProcessCommandLine has "copy " and ProcessCommandLine has "--config" and ProcessCommandLine has "--transfers" | project Timestamp, DeviceName, AccountUpn, FileName, ProcessVersionInfoOriginalFileName, FolderPath, ProcessCommandLine, RcloneSourcePattern, SHA1, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine | order by Timestamp asc
SPL
index=<endpoint_process_index> sourcetype=<process_events_sourcetype> earliest=-7d | eval process_name=lower(coalesce(process_name,FileName)), original_name=lower(coalesce(original_name,ProcessVersionInfoOriginalFileName)), process_command_line=coalesce(process_command_line,ProcessCommandLine), device=coalesce(device,DeviceName,host), user=lower(coalesce(user,AccountUpn)) | where ( process_name="msiexec.exe" AND ( like(lower(process_command_line),"%http://%") OR like(lower(process_command_line),"%https://%") OR like(lower(process_command_line),"%.msi%") ) ) OR process_name="rclone.exe" OR original_name="rclone.exe" | eval rclone_source_pattern=if( (process_name="rclone.exe" OR original_name="rclone.exe") AND like(lower(process_command_line),"%copy %") AND like(lower(process_command_line),"%--config%") AND like(lower(process_command_line),"%--transfers%"), 1,0 ) | fields _time device user process_name original_name process_command_line rclone_source_pattern SHA1 SHA256 InitiatingProcessFileName InitiatingProcessCommandLine | sort 0 _time
What to look for
Alternate remote-management tooling or Rclone execution that confirms persistence/exfiltration progression beyond the original Quick Assist foothold.
Technical details
Tested signal
msiexec-driven remote-management installation or rclone.exe with copy/config/parallel-transfer arguments.
Assumptions
Process telemetry covers the affected devices through the exfiltration window.
Data requirements and relevant fields
process
Microsoft Defender for Endpoint process creation telemetry with user, stable process identity, parent context, path, command line, and hashes.
Timestamp
DeviceId
DeviceName
FileName
FolderPath
ProcessId
ProcessUniqueId
ProcessCommandLine
ProcessVersionInfoOriginalFileName
AccountUpn
AccountObjectId
AccountName
SHA1
SHA256
InitiatingProcessFileName
InitiatingProcessCommandLine
InitiatingProcessId
InitiatingProcessUniqueId
InitiatingProcessAccountUpn
InitiatingProcessAccountObjectId
KQL schema
Validate Microsoft Defender for Office 365 / Teams message coverage, Defender for Endpoint deployment, field population, and local retention.
SPL schema
Replace index/sourcetype placeholders and normalize collaboration, process, network, and account fields to the local data model.
Limitations
RMM software and Rclone have legitimate administrative and backup uses.
The source-specific Rclone switches are a high-confidence retrospective pivot, not a universal requirement.
KQL uses Microsoft Defender XDR collaboration and endpoint telemetry. SPL is a normalized raw-event scaffold and requires local field mapping.
More reasoning
Observation
The source campaign deployed Level RMM and later used Rclone for cloud exfiltration.
Working explanation
The actor may have established a backup control channel and begun transferring selected business data.
What was checked
Search msiexec-driven RMM installation and Rclone process execution, preserving command-line arguments and parent context.
Interpretation
Both tools are legitimate in some environments; owner, installation path, destination, and change history must be checked.
Supporting evidence
E-05

Response

Actions to take

Contain affected systems, preserve evidence, and scope the same behavior elsewhere.

Isolate the initially compromised endpoint and any laterally accessed devices.
Terminate unauthorized Quick Assist, RMM, WinRM, and remote shell sessions.
Reset or revoke credentials used for credential-backed lateral movement.
Block confirmed malicious C2 and exfiltration infrastructure while preserving legitimate remote-support services needed by the business.
Remove attacker-deployed RMM software, side-loaded modules, registry-backed loader state, and related persistence.
Scope WinRM targets, especially domain controllers and other high-value systems.
Identify the Rclone destination, transferred paths, and data categories and initiate data-exposure response where required.
Restrict WinRM to authorized management workstations and administrative identities.
Harden Teams external-access policy and teach users to verify IT/helpdesk identity before accepting remote support.
Require a trusted internal verification method for unsolicited support interactions.

Conclusion

What was concluded

Microsoft documented a human-operated intrusion chain in April 2026 that begins with cross-tenant Teams helpdesk impersonation rather than email. The attacker persuades the user to launch legitimate remote-support software, then turns that access into shell execution, discovery, payload activity, native WinRM lateral movement, alternate RMM, and data exfiltration.

This Case preserves that progression without implying that every observed intrusion contained every possible branch. The investigation is built around the transitions a SOC can actually correlate across collaboration, endpoint, and network telemetry.

The trusted application names, Level RMM behavior, WinRM port, and Rclone pattern are source-backed retrospective pivots from Microsoft's report.

Technical detail

Technical evidence

Stable evidence anchors preserve the fields behind the investigation story.

Source: Microsoft April 2026 intrusion research
Telemetry class: Saas Audit
Timestamp: Not applicable

Microsoft documented attackers initiating cross-tenant Teams contact while impersonating IT or helpdesk personnel and using lures such as security updates, spam-filter updates, or account verification.

Channel: External Microsoft Teams
Persona: IT / Helpdesk
Objective: Convince user to start remote assistance

Referenced by

Step 01

Source: Microsoft April 2026 intrusion research
Telemetry class: Process
Timestamp: Not applicable

After the user granted access, QuickAssist.exe and standard elevation prompts were followed rapidly by cmd.exe or PowerShell activity.

Remote tool: Quick Assist
Execution: cmd.exe / PowerShell
Tempo: Often under one minute

Referenced by

Step 02

Source: Microsoft April 2026 intrusion research
Telemetry class: Process
Timestamp: Not applicable

The actor performed rapid interactive reconnaissance and later used trusted vendor-signed applications alongside attacker-controlled modules for malicious execution.

Recon window: First 30-120 seconds
Trusted hosts: AcroServicesUpdater2_x64.exe / ADNotificationManager.exe / DlpUserAgent.exe
Execution style: DLL side-loading

Referenced by

Step 03
Step 04

Source: Microsoft April 2026 intrusion research
Telemetry class: Network
Timestamp: Not applicable

The compromised endpoint initiated WinRM traffic over TCP 5985 toward additional domain-joined systems, including high-value identity infrastructure.

Protocol: WinRM
Port: 5985/tcp
Target class: Domain-joined systems / domain controllers

Referenced by

Step 05

Source: Microsoft April 2026 intrusion research
Telemetry class: Process
Timestamp: Not applicable

Late-stage activity included deployment of Level RMM through msiexec and use of Rclone to transfer business-relevant data to external cloud storage.

Alternate access: Level RMM
Installer: msiexec.exe
Exfil tool: rclone.exe

Referenced by

Step 06

Detection engineering

Would your SOC catch this behavior?

See the detection built for this investigation.

View detection

Behavior context

ATT&CK and sources

Behavior mapping

MITRE ATT&CK

T1566.003 · Spearphishing via ServiceEnterprise ATT&CK 19.2
The initial social-engineering contact occurs through external Microsoft Teams collaboration while impersonating helpdesk or IT staff.
T1219.002 · Remote Desktop SoftwareEnterprise ATT&CK 19.2
Quick Assist and later commercial remote-management tooling provide interactive remote access.
T1021.006 · Windows Remote ManagementEnterprise ATT&CK 19.2
The actor uses Windows Remote Management over TCP 5985 for credential-backed lateral movement.
T1567.002 · Exfiltration to Cloud StorageEnterprise ATT&CK 19.2
Rclone transfers staged business data to external cloud storage.

These mappings describe the behavior examined here. They do not establish attribution.

Review boundary

Sources and limits

Last reviewed: Aug 30, 2026
External sources: 4

This case documents the available evidence and analytical limits; control effectiveness is environment-specific.

Cross-tenant helpdesk impersonation to data exfiltration: A human-operated intrusion playbookMicrosoft Security
Help on the line: How a Microsoft Teams support call led to compromiseMicrosoft Security
DeviceProcessEventsMicrosoft Learn
DeviceNetworkEventsMicrosoft Learn

Sections

What happened
Investigation
Actions
Conclusion
Evidence
Detection
Context

What happened

External Teams account impersonates IT support

User launches Quick Assist and grants control

Shells and rapid reconnaissance appear

Trusted applications host attacker-controlled code

WinRM pivots toward high-value systems

Alternate RMM and Rclone extend access and remove data

What was checked

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation

Working explanation

What was checked

Interpretation

Next pivot

What this checks

KQL

SPL

What to look for

Tested signal

Assumptions

Data requirements and relevant fields

KQL schema

SPL schema

Limitations

Observation