Two human-operated intrusions used Microsoft Teams to impersonate IT staff and socially engineer users into granting remote access via Quick Assist. Attackers deployed portable runtimes to perform network discovery and assessed Active Directory Certificate Services (AD CS) for authentication exploitation. One intrusion exploited an ESC1-vulnerable certificate template to obtain privileged authentication certificates and performed DCSync operations. The other used PetitPotam to coerce domain-controller authentication and relayed it via ESC8 to AD CS Web Enrollment, obtaining a domain-controller certificate for Kerberos authentication. Automated defenses limited the first intrusion except for an excluded privileged identity that enabled data exfiltration, while customer-led isolation stopped the second intrusion after Defender alerts.