Microsoft's Oct 30 post covers two hands-on-keyboard intrusions that shared an entry path and split at the certificate layer. No Teams vulnerability was used.

• Entry: Teams chats and calls from organization-themed onmicrosoft.com tenants with support-style display names; the user opens Quick Assist and reads out the code.
• Staging: an archive dropped in Downloads, extracted to a new %AppData%\Roaming\KB<digits>\ folder, and run with a portable Python, Bun (renamed, but still carrying Bun version metadata) or Java runtime, followed by ipconfig /all, tasklist, LDAPS and SMB to domain infrastructure.
• Case 1 (ESC1): a template that lets the requester supply the subject gave certificates for 3, then 8 more, privileged accounts across two waves 90 minutes apart. DCSync ran within seconds. Defender attack disruption blocked over 1,000 later SMB and logon attempts, but one privileged account excluded from automatic response was used to run Rclone renamed as SearchApp.exe and copy a file share to an external SFTP server.
• Case 2 (ESC8): PetitPotam coerced the DC's machine account to authenticate; the NTLM login was relayed to /certsrv Web Enrollment, a Domain Controller template certificate was issued, and PKINIT returned a TGT for the DC. The customer isolated the workstation after ESC8 alerts.

Hunt for: external Teams chats or TeamsImpersonationDetected events followed by Quick Assist; bun.exe/java.exe (check original file name, not just the name on disk) running .js or .java from AppData\Roaming\KB* and connecting to ports 88, 445 or 636; certificate requests where the SAN names a different, privileged account; a DC machine account authenticating to the CA from a non-DC host; PKINIT logons for machine accounts from workstations; Rclone-like command lines under other names. IOCs (SHA-256): 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript), f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python).

Fix: remove enrollee-supplied subject from authentication templates or require manager approval, enable EPA and require HTTPS on Web Enrollment or turn it off (KB5005413), enable Certification Services auditing, restrict Teams external access to allowlisted domains, and treat every automatic-containment exclusion as an incident decision with a manual follow-up. Revoking a certificate does not kill Kerberos tickets already issued.