Content by Microsoft Security Research, Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari (1)

Microsoft Security Research, Sagar Patil, Arlette Umuhire Sangwa, Jesse Birch and Ravikant Tiwari break down a hands-on-keyboard intrusion that starts with Microsoft Teams helpdesk impersonation, escalates through remote-control sessions and a malicious MSI, and ends with Node.js-based persistence and WinRM lateral movement, with concrete mitigations and Defender XDR hunting queries.