Technique Profile: Cross-tenant Helpdesk Impersonation Leading To Data Exfiltration

A sophisticated and increasingly prevalent attack chain has been observed where threat actors abuse Microsoft Teams’ external collaboration capabilities to impersonate IT or helpdesk personnel, social-engineer users into granting remote desktop access, and then systematically pivot across the enterprise toward domain controllers, sensitive data stores, and cloud infrastructure. Unlike traditional email phishing, this campaign exploits a collaboration workflow that users instinctively trust, an inbound “support call” from what appears to be an internal IT team

Once the user grants remote access via Quick Assist or similar tools, attackers move fast: reconnaissance takes under two minutes, payload staging follows immediately, and lateral movement toward domain controllers can occur within the same session. The campaign concludes with Rclone-based exfiltration of business-relevant documents to attacker-controlled cloud storage

Any organisation using Microsoft Teams with external collaboration enabled is a potential target. The attack requires no vulnerability, no malware delivered via email, and no exploit, only a user who trusts an unsolicited support interaction

Threat Overview

The intrusion chain begins with a cross-tenant Microsoft Teams message where the attacker impersonates helpdesk personnel using lures such as “Microsoft Security Update”, “Spam Filter Update”, or “Account Verification”. Voice phishing (vishing) is often layered on top to increase urgency and compliance. In some cases, this initial contact is preceded by a mailbombing event, followed by a “helpdesk assistance” message designed to overwhelm the user and increase the likelihood that they accept external support. Critically, Teams presents multiple security warnings at first contact, including external sender labels, Accept/Block prompts, spam/phishing indicators, and Safe Links checks, but this attack succeeds only when users actively bypass those controls

After consent is obtained, attackers establish interactive control via Quick Assist, perform rapid reconnaissance, stage DLL sideloading payloads, establish command and control infrastructure, move laterally via WinRM, deploy persistent RMM tooling, and exfiltrate data using Rclone, all within a single intrusion session

Technical Analysis

This intrusion chain begins with cross-tenant social engineering in Microsoft Teams, where external actors impersonate internal IT or helpdesk personnel to establish trust and prompt users into initiating remote support sessions. Once the user accepts the interaction and launches a tool such as Quick Assist, the attacker gains interactive control of the endpoint under the guise of legitimate support activity

After initial access, the attacker performs rapid system reconnaissance to validate privileges, domain context, and network reachability using native Windows utilities and lightweight command execution. This phase is typically short-lived and designed to quickly determine whether the host provides a viable pivot point within the enterprise environment

The attack then transitions into execution and staging, where trusted, signed binaries are abused for DLL side-loading to execute attacker-controlled payloads under legitimate process contexts. Payloads are often placed in writable directories such as ProgramData and executed through renamed or abused vendor applications to blend into normal software behavior

To maintain persistence and operational flexibility, attackers may store encrypted configuration data within registry keys and decrypt it at runtime, reducing reliance on disk-based artifacts. Command and control is established over HTTPS, often using infrastructure that mimics legitimate software update traffic to evade network-based detection

For lateral movement, adversaries leverage credential-backed remote administration protocols such as WinRM to pivot across domain-joined systems, with a focus on identity infrastructure and high-value assets. In parallel, additional remote management tools may be deployed to maintain redundant access paths and ensure persistence even if initial access vectors are disrupted

In the final stage, targeted data exfiltration is performed using synchronization utilities such as Rclone, with filters applied to selectively extract business-relevant data while minimizing detection footprint. Throughout the attack, the heavy reliance on legitimate tools and native protocols enables adversaries to blend into normal administrative and IT support activity, significantly complicating detection and response efforts

Attack Chain

The stages are described separately below:

1. Initial Access via Teams Social Engineering
   • External tenant impersonates IT/helpdesk in Microsoft Teams
   • User receives chat/call request appearing legitimate
   • Attacker may reinforce trust via vishing (voice-based social engineering)
   • User is convinced to launch Quick Assist or similar remote support tool
     
2. Remote Access Establishment
   • Execution of QuickAssist.exe
   • Consent prompts handled via consent.exe
   • Attacker gains interactive desktop control
   • Rapid transition from chat to system-level execution
     
3. Reconnaissance & Validation
   • Execution of:
     • whoami, ipconfig, nltest, route print
   • Registry queries for OS/domain context
   • Network reachability checks for lateral movement planning
     
4. Payload Staging & Execution
   • Dropped payloads in writable paths (e.g., ProgramData)
   • DLL side-loading via signed binaries:
     • AcroServicesUpdater2_x64.exe → msi.dll
     • ADNotificationManager.exe → vcruntime140_1.dll
     • DlpUserAgent.exe →  mpclient.dll
     • werfault.exe →  Faultrep.dll
   • Execution under trusted application contexts
     
5. Persistence & Loader Behavior
   • Registry-based encrypted payload storage (HKCU)
   • In-memory decryption of configuration data
   • Fileless execution patterns aligned with loader frameworks
     
6. Command & Control (C2)
   • Outbound HTTPS traffic over port 443
   • Cloud-hosted, dynamically rotating infrastructure
   • Beaconing disguised as legitimate update traffic
7. Lateral Movement
   • WinRM-based execution (TCP 5985)
   • Credential-backed movement across domain-joined systems
   • Targeting of identity infrastructure (e.g., domain controllers)
8. Data Exfiltration
   • Use of Rclone for selective synchronization
   • File-type exclusions to reduce detection footprint
   • Upload to external cloud storage platforms
     

MITRE ATT&CK Mapping

• Restrict external Microsoft Teams communication to trusted domains only
• Enforce clear external tenant and sender labeling in Teams
• Limit unsolicited cross-tenant contact and unknown helpdesk interactions
• Apply device- and identity-based controls before allowing remote support sessions
• Enable Safe Links for Microsoft Teams with time-of-click protection
• Ensure Zero-hour Auto Purge (ZAP) is enabled for malicious message removal
• Block or restrict remote support tools such as Quick Assist and similar RMM tools
• Enable Attack Surface Reduction (ASR) rules in block mode
• Use Windows Defender Application Control (WDAC) to prevent DLL sideloading from ProgramData and AppData
• Monitor for suspicious execution of signed or trusted binaries
• Enforce Multi-Factor Authentication (MFA) for all privileged actions
• Require compliant and managed devices through Conditional Access policies
• Restrict WinRM usage to authorized and hardened administrative workstations
• Detect and monitor usage of data exfiltration tools such as Rclone
• Enable Network Protection to block malicious or newly registered domains
• Monitor registry modifications to persistence (ASEP) locations by non-installation processes
• Detect abnormal outbound HTTPS beaconing patterns
• Train users to identify helpdesk impersonation attempts in collaboration tools
• Establish verbal authentication codes for IT helpdesk verification
• Define and communicate official IT support channels and identifiers
• Educate users on distinguishing external vs internal Teams identities
• Require reporting of unexpected helpdesk messages or security-related URLs
• Treat all unsolicited external IT support contact as inherently suspicious
• Restrict external collaboration workflows and enforce strict access boundaries
• Combine ASR, WDAC, MFA, and Conditional Access for layered defense
• Limit lateral movement paths by restricting administrative protocols like WinRM

Teams → RMM correlation

let _timeFrame = 30m;
// Teams message signal
let _teams =
    MessageEvents
    | where Timestamp > ago(30d)
    | extend Recipient = parse_json(RecipientDetails)
    | mv-expand Recipient
    | extend
        VictimAccountObjectId = tostring(Recipient.RecipientObjectId),
        VictimRecipientDisplayName = tostring(Recipient.RecipientUserDisplayName)
    | project
        TTime = Timestamp,
        SenderEmailAddress,
        SenderDisplayName,
        VictimRecipientDisplayName,
        VictimAccountObjectId;

// RMM launches on endpoint side

let _rmm =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ ("QuickAssist.exe", "AnyDesk.exe", "TeamViewer.exe")
    | extend VictimAccountObjectId = tostring(InitiatingProcessAccountObjectId)
    | project
        DeviceName,
        QTime = Timestamp,
        RmmTool = FileName,
        VictimAccountObjectId;
_teams
| where isnotempty(VictimAccountObjectId)
| join kind=inner _rmm on VictimAccountObjectId
| where isnotempty(DeviceName)
| where QTime between ((TTime) .. (TTime + (_timeFrame)))
| project
    DeviceName,
    SenderEmailAddress,
    SenderDisplayName,
    VictimRecipientDisplayName,
    VictimAccountObjectId,
    TTime,
    QTime,
    RmmTool
| order by QTime desc

Execution

DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName =~ "cmd.exe"
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has_all (
"/S /D /c",
"\" set /p=\"PK\"",
"1>"
)

ZIP → ProgramData service path → signed host sideload

let _timeFrame = 10m;
let _armOrDevice =
    DeviceFileEvents
    | where Timestamp > ago(30d)
    | where FolderPath startswith "C:\\ProgramData\\"
        or FolderPath startswith "D:\\ProgramData\\"
    | where ActionType in ("FileCreated", "FileRenamed")
    | where FileName endswith ".dll"
        or FileName endswith ".exe"
        or FileName endswith ".zip"
    | where FolderPath !has "\\Microsoft\\Windows Defender\\"
        and FolderPath !has "\\Microsoft\\Windows\\WER\\"
        and FolderPath !has "\\Package Cache\\"
        and FolderPath !has "\\Microsoft\\ClickToRun\\"
        and FolderPath !has "\\Dell\\"
        and FolderPath !has "\\Lenovo\\"
        and FolderPath !has "\\ASUS\\"
        and FolderPath !has "\\Adobe\\ARM\\"
    | project DeviceName, First=Timestamp, FileName, FolderPath;

let _hostRun =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ (
        "AcroServicesUpdater2_x64.exe",
        "DlpUserAgent.exe",
        "ADNotificationManager.exe",
        "werfault.exe"
    )
    | where FolderPath startswith "C:\\ProgramData\\"
        or FolderPath startswith "D:\\ProgramData\\"
    | where FolderPath !has "\\Microsoft\\Windows Defender\\"
        and FolderPath !has "\\Adobe\\ARM\\"
    | project
        DeviceName,
        Run=Timestamp,
        Host=FileName,
        ProcessCommandLine,
        ProcessFolderPath=FolderPath;
_armOrDevice

| join kind=inner _hostRun on DeviceName
| where Run between (First .. (First + (_timeFrame)))
| summarize
    First=min(First),
    Run=min(Run),
    Files=make_set(FileName, 10),
    Paths=make_set(FolderPath, 10)
    by DeviceName, Host, ProcessCommandLine, ProcessFolderPath
| order by Run desc

PowerShell → high‑risk TLD → writes %AppData%/Roaming EXE

let _timeFrame = 5m;
let _psNet = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| where RemoteUrl matches regex @"(?i)\.(top|xyz|zip|click)$"
| project DeviceName, NetTime=Timestamp, RemoteUrl, RemoteIP;

let _exeWrite = DeviceFileEvents
| where Timestamp > ago(30d)
| where FolderPath has @"\AppData\Roaming\" and FileName endswith ".exe"
| project DeviceName, WTime=Timestamp, FileName, FolderPath, SHA256;
_psNet
| join kind=inner _exeWrite on DeviceName
| where WTime between (NetTime .. (NetTime + (_timeFrame)))
| project
DeviceName,
NetTime,
RemoteUrl,
RemoteIP,
WTime,
FileName,
FolderPath,
SHA256
| order by WTime desc

Registry breadcrumbs / ASEP anomalies

DeviceRegistryEvents
| where Timestamp > ago(30d)
| where RegistryKey has @"\SOFTWARE\Classes\Local Settings\Software\Microsoft"
| where RegistryValueName in~ (
    "UCID",
    "UFID",
    "XJ01",
    "XJ02",
    "UXMP"
)
| where ActionType in (
    "RegistryValueSet",
    "RegistryValueDeleted"
)

| where InitiatingProcessFileName in~ (
    "AcroServicesUpdater2_x64.exe",
    "DlpUserAgent.exe",
    "ADNotificationManager.exe",
    "werfault.exe"
)

| project
    Timestamp,
    DeviceName,
    ActionType,
    RegistryKey,
    RegistryValueName,
    RegistryValueData,
    PreviousRegistryValueData,
    InitiatingProcessFileName

| order by Timestamp desc

Non‑browser process → API‑Gateway → internal AD and WinRm protocols

let _timeFrame = 10m;
let _net1 =
    DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteUrl has ".execute-api."
    | where isnotempty(InitiatingProcessFileName)
    | where InitiatingProcessFileName !in~ (
        "chrome.exe",
        "msedge.exe",
        "firefox.exe",
        "opera.exe",
        "brave.exe",
        "iexplore.exe"
    )

    | where InitiatingProcessFolderPath !startswith "C:\\Program Files"
        and InitiatingProcessFolderPath !startswith "C:\\Program Files (x86)"
    | project
        DeviceName,
        Proc=InitiatingProcessFileName,
        ProcPath=InitiatingProcessFolderPath,
        AccountName=InitiatingProcessAccountName,
        OutTime=Timestamp,
        RemoteUrl,
        C2IP=RemoteIP;

let _net2 =
    DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemotePort in (135, 389, 445, 636, 5985, 5986)
    | where isnotempty(InitiatingProcessFileName)
    | where InitiatingProcessFileName !in~ (
        "chrome.exe",
        "msedge.exe",
        "firefox.exe",
        "svchost.exe",
        "lsass.exe",
        "System"
    )

    | project
        DeviceName,
        Proc=InitiatingProcessFileName,
        InTime=Timestamp,
        InternalIP=RemoteIP,
        RemotePort;
_net1
| join kind=inner _net2 on DeviceName, Proc
| where InTime between (OutTime .. (OutTime + (_timeFrame)))
| project
    DeviceName,
    Proc,
    ProcPath,
    AccountName,
    OutTime,
    RemoteUrl,
    C2IP,
    InTime,
    InternalIP,
    RemotePort
| order by InTime desc

DLL side‑loading through trusted signed applications → HTTPs and WinRm outbound connections

let _timeFrame = 10m;
let _c2 =
    DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where InitiatingProcessFileName in~ (
        "AcroServicesUpdater2_x64.exe",
        "DlpUserAgent.exe",
        "ADNotificationManager.exe",
        "werfault.exe"
    )
    | where RemotePort == 443
    | project
        DeviceName,
        C2Time=Timestamp,
        InitiatingProcessFileName,
        C2IP=RemoteIP,
        C2Url=RemoteUrl;

let _winrm =
    DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where InitiatingProcessFileName in~ (
        "AcroServicesUpdater2_x64.exe",
        "DlpUserAgent.exe",
        "ADNotificationManager.exe",
        "werfault.exe"
    )
    | where RemotePort in (5985, 5986)
    | project
        DeviceName,
        WinRMTime=Timestamp,
        InitiatingProcessFileName,
        WinRMTarget=RemoteIP,
        WinRMPort=RemotePort;
_c2
| join kind=inner _winrm on DeviceName, InitiatingProcessFileName
| where WinRMTime between (C2Time .. (C2Time + (_timeFrame)))
| project
    DeviceName,
    InitiatingProcessFileName,
    C2Time,
    C2IP,
    C2Url,
    WinRMTime,
    WinRMTarget,
    WinRMPort
| order by C2Time desc

PowerShell history deletion

DeviceFileEvents
| where Timestamp > ago(30d)
| where FileName =~ "ConsoleHost_history.txt"
| where ActionType == "FileDeleted"
| where InitiatingProcessFileName in~ (
    "AcroServicesUpdater2_x64.exe",
    "DlpUserAgent.exe",
    "ADNotificationManager.exe",
    "werfault.exe",
    "cmd.exe",
    "powershell.exe",
    "pwsh.exe"
)
| project
    Timestamp,
    DeviceName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    FolderPath
| order by Timestamp desc

Reconnaissance burst (cmd / PowerShell)

let _reconWindow = 10m;
let _rmm =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ ("QuickAssist.exe", "AnyDesk.exe", "TeamViewer.exe")
    | project DeviceName, RMMTime=Timestamp;

let _recon =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any (
        "whoami",
        "nltest",
        "net user",
        "ipconfig /all",
        "arp -a",
        "route print",
        "query user",
        "whoami /all",
        "whoami /groups",
        "whoami /priv"
    )
    | where InitiatingProcessFileName !in~ (
        "m_agent_service.exe",
        "updater.exe",
        "msiexec.exe",
        "asussplendid.exe",
        "icloudhome.exe",
        "dropbox.exe",
        "code.exe",
        "TiWorker.exe",
        "MsMpEng.exe",
        "ccmexec.exe",
        "cscript.exe",
        "wscript.exe"
    )
    | where InitiatingProcessFileName !has "agent"

        and InitiatingProcessFileName !has "update"

        and InitiatingProcessFileName !has "install"
    | project
        Timestamp,
        DeviceName,
        FileName,
        InitiatingProcessFileName,
        ProcessCommandLine;
_rmm

| join kind=inner _recon on DeviceName
| where Timestamp between (RMMTime .. (RMMTime + (_reconWindow)))
| summarize
    RMMTime=min(RMMTime),
    eventCount=count(),
    FileNames=make_set(FileName),
    InitiatingProcessFileNames=make_set(InitiatingProcessFileName),
    ProcessCommandLines=make_set(ProcessCommandLine, 5)
    by DeviceName
| where eventCount > 2
| project
    DeviceName,
    RMMTime,
    eventCount,
    FileNames,
    InitiatingProcessFileNames,
    ProcessCommandLines
| order by eventCount desc

Data exfiltration

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "rclone.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe"
| where ProcessCommandLine has_all (
    "copy ",
    "--config rclone_uploader.conf",
    "--transfers 16",
    "--checkers 16",
    "--buffer-size 64M",
    "--max-age=3y",
    "--exclude *.mdf"
)

Quick Assist–anchored recon (no staging writes within 10 minutes)

let _reconWindow = 10m;
let _stageWindow = 15m;
let _rmm =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ ("QuickAssist.exe", "AnyDesk.exe", "TeamViewer.exe")
    | project DeviceName, RMMTime=Timestamp;
let _recon =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any (
        "whoami",
        "whoami /all",
        "whoami /groups",
        "whoami /priv",
        "nltest",
        "net user",
        "net localgroup",
        "query user",
        "ipconfig /all",
        "arp -a",
        "route print"
    )
    | where InitiatingProcessFileName !in~ (
        "m_agent_service.exe",
        "updater.exe",
        "msiexec.exe",
        "asussplendid.exe",
        "icloudhome.exe",
        "dropbox.exe",
        "code.exe",
        "explorer.exe",
        "TiWorker.exe",
        "MsMpEng.exe",
        "ccmexec.exe",
        "GoogleUpdate.exe",
        "setup.exe"
    )
    | where InitiatingProcessFileName !has "agent"
        and InitiatingProcessFileName !has "update"
        and InitiatingProcessFileName !has "install"
        and InitiatingProcessFileName !has "deploy"
    | where ProcessCommandLine !has "Program Files"
        and ProcessCommandLine !has "uninstall"
        and ProcessCommandLine !has "InventoryInstall"
        and ProcessCommandLine !has "spool\\drivers"
        and ProcessCommandLine !has "AppData\\Roaming\\Apple"
        and ProcessCommandLine !has "AppData\\Local\\Apple"
    | project
        DeviceName,
        ReconTime=Timestamp,
        ReconCmd=ProcessCommandLine,
        ReconProc=FileName,
        InitiatingProc=InitiatingProcessFileName;
let _staging =
    DeviceFileEvents
    | where Timestamp > ago(30d)
    | where ActionType in ("FileCreated", "FileRenamed")
    | where FileName endswith ".zip"
        or FileName endswith ".exe"
        or FileName endswith ".dll"
    | where FolderPath !has "\\Program Files"
        and FolderPath !has "\\Windows\\Temp"
        and FolderPath !has "\\Google\\"
        and FolderPath !has "\\Apple\\"
    | project
        DeviceName,
        STime=Timestamp,
        StageFile=FileName,
        StagePath=FolderPath;
let _rmmRecon =
    _rmm
    | join kind=inner _recon on DeviceName
    | where ReconTime between (RMMTime .. (RMMTime + (_reconWindow)))
    | project DeviceName, RMMTime, ReconTime, ReconProc, ReconCmd, InitiatingProc;
_rmmRecon
| join kind=leftouter _staging on DeviceName
| extend HasStagingInWindow = iff(
    STime between (RMMTime .. (RMMTime + (_stageWindow))), 1, 0)
| summarize HasStagingInWindow=max(HasStagingInWindow)
    by DeviceName, RMMTime, ReconTime, ReconProc, ReconCmd, InitiatingProc
| where HasStagingInWindow == 0
| project
    DeviceName,
    RMMTime,
    ReconTime,
    ReconProc,
    ReconCmd,
    InitiatingProc
| order by ReconTime desc

This technique reflects a broader shift from traditional phishing to interactive social engineering attacks inside collaboration platforms. Rather than delivering payloads directly, attackers rely on users to initiate compromise themselves through trusted workflows

Key trends include:

• Increased abuse of Microsoft Teams external collaboration
• Heavy reliance on legitimate remote support tools
• Growth in “helpdesk impersonation” as a primary intrusion vector
• Blending of human manipulation with legitimate administrative tooling

• Microsoft Teams (external collaboration features)
• Quick Assist / remote support tools
• Windows WinRM and native admin protocols
• Microsoft Entra ID authentication workflows
• Microsoft Defender for Endpoint telemetry
• Cloud storage services used for exfiltration (via Rclone)

This campaign represents a meaningful evolution in enterprise social engineering: it requires no vulnerability, no malicious email attachment, and no exploit kit. The attacker’s primary weapon is the enterprise’s own collaboration infrastructure, and the “mechanism of delivery” is a user who believes they are receiving legitimate IT support

The business and operational risks are severe and compounding:

• Domain controller compromise: WinRM-based lateral movement targeting identity infrastructure can result in full Active Directory takeover, enabling attackers to create persistent admin accounts, modify GPOs, and establish long-term footholds that survive endpoint remediation.
• Credential exfiltration at scale: Harvested credentials from a single endpoint can provide access to dozens of downstream systems, VPNs, cloud workloads, and SaaS platforms.
• Business data exfiltration: Rclone’s targeted file-type filtering indicates deliberate selection of commercially sensitive documents, contracts, financial data, and strategic plans, creating regulatory breach notification risk under GDPR and sector-specific frameworks
• Stealth and dwell time: The use of signed legitimate executables (Quick Assist, WinRAR, Adersoft tools), blockchain-based C2 configuration, and commercial RMM platforms means this campaign consistently evades signature-based and network-level detection. Dwell time before detection significantly amplifies impact
• Compounding threat actor handoffs: Microsoft has observed that in some campaigns, initial access brokers may hand off to different threat actors mid-intrusion, meaning later stages can differ materially in objective and tooling

This technique profile underscores how attackers increasingly weaponise the trust users place in enterprise collaboration platforms, and why identity-aware, behaviour-based detection across Teams, endpoint, and network telemetry is now a fundamental detection requirement, not an enhancement

• 24/7 monitoring through Microsoft Sentinel for cross-tenant impersonation patterns
• Managed Detection & Response (MDR) using Microsoft Defender for Endpoint
• Threat hunting across identity and collaboration telemetry for early-stage social engineering indicators
• Incident response support for containment of remote access abuse and lateral movement
• Continuous exposure assessment aligned with Microsoft security best practices
• Detection engineering for Teams-based impersonation and WinRM lateral movement patterns