An exception remained usable
Microsoft’s October 30 investigation of two intrusions identifies a consequential gap in automated containment: one privileged account remained available to attackers and later supported data theft. Both cases began with fraudulent IT support contacts through Teams, followed by user-approved remote access, primarily through Quick Assist.
The intrusion moved beyond the workstation
According to Microsoft, the first attacker exploited a certificate-template configuration to obtain privileged authentication certificates. Defender restricted covered identities, but an excluded account remained usable. The intruder subsequently copied files to an external destination. In the second case, a different certificate-abuse technique produced a domain-controller identity; the customer isolated the workstation after alerts, and Microsoft observed no further progression.
A support incident with a wider perimeter
Microsoft describes two investigations. Microsoft does not attribute them to a named group and says no Teams vulnerability was exploited. The consequential finding is that a successful response against several accounts can coexist with a surviving privileged route. That complicates any incident assessment based only on the volume of blocked activity.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
