The Attack: From Help Desk Impersonation to Data Exfiltration
Microsoft recently disclosed two intrusions where attackers impersonated IT support on Teams, convinced employees to grant them Quick Assist remote access, and then exploited insecure Active Directory Certificate Services (AD CS) configurations to obtain privileged login certificates. In one case, the attacker successfully exfiltrated company data to an external SFTP server.
The attack chain worked like this: the scumbag called employees on Teams pretending to be internal IT, talked them into opening Quick Assist and reading back the connection code, then took direct control of the workstation. From there, they dropped an archive into the Downloads folder, unpacked it into a folder named to look like a Windows update, and ran the contents using a portable Python, Bun, or Java runtime — no installation, no admin rights needed.
With a foothold established, they exploited weaknesses in certificate templates (ESC1 and ESC8) to request certificates for privileged accounts, including one for a domain controller. In the first intrusion, automatic attack disruption blocked most of the privileged identities, but one account was excluded from the response. The attacker kept using it, reached a file server, and ran a renamed copy of Rclone to copy data from a share to an outside SFTP server.
Microsoft’s guidance focuses on configuration hardening: review certificate templates, enable Extended Protection for Authentication on web enrollment endpoints, limit external Teams tenants, train users to verify support requests through internal channels. All reasonable advice. But it’s all downstream — it assumes the attacker already has a foothold and asks you to harden the privilege escalation path.
Why the Attack Worked: Two File Operations Nobody Stopped
Strip away the social engineering, the AD CS complexity, and the domain controller certificates. The attack still required two simple file operations:
- Writing the portable runtime payload to disk. The attacker dropped an archive, unpacked it, and ran a Python or Java runtime from the Downloads folder. That’s a file write operation — an unauthorized executable landing on the system.
- Bulk-reading files from the share for exfiltration. The attacker used Rclone, renamed to avoid detection, to copy files from a network share to an external SFTP server. That’s hundreds or thousands of file read operations in a short window.
Both are file system operations that happen before the damage is done. The payload has to land before it can run. The files have to be read before they can be stolen.
How FileSure Defend Stops It
FileSure Defend operates at the Windows kernel level via a filter driver. It intercepts file system operations — open, read, write, delete, create, rename — before they complete, and enforces behavioral policies based on which user, which program, and which machine is attempting the operation.
Here’s the specific rule configuration that would have stopped this attack:
Rule 1: Block executable payload drops from remote access tools
- File name filter:
*.exe,*.py,*.jar,*.js,*.bun - Program name filter:
C:\Windows\System32\quickassist.exe,C:\Windows\System32\msra.exe(or any remote access tool) - Operations: Write, Create
- Action: Deny and alert
If Quick Assist (or any remote support tool) tries to write an executable file to disk, FileSure blocks it. The payload never lands. The attacker can’t run it. The rest of the attack chain collapses.
Rule 2: Detect and block bulk file reads by unfamiliar programs
- File name filter:
*(all files, or narrow to*.docx,*.xlsx,*.pdfif you want to focus on documents) - Program name filter: Whitelist known backup and sync tools; deny everything else
- Operations: Read
- Threshold alert: 100+ files read within 60 minutes
- Action: Alert on threshold, optionally deny after threshold
When a renamed copy of Rclone — or any program not on your whitelist — tries to read hundreds of files in an hour, FileSure flags it immediately. You get an alert within seconds. If you’ve configured the rule to block after the threshold, the exfiltration stops mid-operation.
The AD CS certificate abuse is real, and Microsoft’s hardening advice is valid. But the certificate is only useful if the attacker can write tools to disk and read files to steal them. FileSure Defend controls the file operations, so the privilege escalation becomes a lot less useful.
The Upstream Intervention
Most security is reactive — detect the bad thing after it happens, then scramble to contain it. FileSure Defend is preventive. The payload never lands. The bulk file read never completes. The attacker gets a foothold, sure, but they can’t do anything with it.
Microsoft’s report notes that in the first intrusion, automatic attack disruption blocked most of the privileged accounts, but one was excluded and stayed open. That’s the gap. Partial containment reduces the attack but leaves a viable route. FileSure doesn’t rely on identity containment. It controls what happens at the file system level, regardless of which account the attacker is using.
Control the file operations, and the rest of the attack chain — social engineering, certificate abuse, lateral movement — becomes a lot harder to execute.
Ready to stop payload drops and bulk exfiltration before they start? Start a free trial of FileSure Defend at bystorm.com — no credit card required, full functionality for 21 days.
Source: Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data
Category: Threat Intelligence
Tags: social engineering, active directory certificate services, ad cs, esc1, esc8, petitpotam, rclone, data exfiltration, kernel filter driver, file system security
