Search — “searchapp.exe”

Microsoft investigated two unattributed intrusions where attackers impersonated IT support on Teams from external onmicrosoft.com tenants, got users to grant Quick Assist sessions, staged archives into KB-prefixed user-profile folders and ran payloads with portable/renamed Python, Bun or Java runtimes, then performed discovery and AD CS abuse. Case 1 abused an ESC1 template for privileged certificates, ran DCSync, and exfiltrated file-share data via Rclone renamed SearchApp.exe to an external SFTP server through a privileged account excluded from automatic disruption. Case 2 used PetitPotam to coerce DC NTLM auth, relayed it to AD CS Web Enrollment (ESC8), obtained a DC certificate and a TGT via PKINIT before the workstation was isolated. Hunt for Quick Assist sessions followed by runtimes executing from KB* AppData folders, anomalous certificate requests with requester-supplied SANs, /certsrv requests authenticated as DC machine accounts from other hosts, and PKINIT from workstations.