Through Microsoft Teams, cybercriminals are impersonating IT support personnel in order to gain access to corporate systems and exploit vulnerabilities in Active Directory Certificate Services (AD CS).
As the outcome of the social engineering and misconfigured certificate services, attackers obtained authentication certificates for privileged accounts, including domain controllers, through two human-operated intrusions identified by Microsoft Threat Intelligence.
In accordance with Microsoft's investigation published on October 30, 2026, both incidents were initiated by attackers posing as internal IT or help desk staff through Teams messages and phone calls.
By using names related to support and familiar-looking display names associated with external Microsoft tenants, attackers convinced employees to open Quick Assist, a remote assistance application on Windows, and provide the connection code to the attacker.
It was through this process that the attackers were able to gain direct control over the targeted workstations.
After gaining initial access, attackers transferred archive files into the Downloads folder and extracted the contents of the archive files into newly created directories resembling Windows update folders. The extracted files were executed using Python, Bun, or Java runtimes.
By using these tools, malicious scripts could be executed from user-accessible locations, while renamed executables retained the metadata associated with legitimate software files.
In order to conduct reconnaissance on the system and network, the attackers examined Windows versions, network configurations, running processes, and connections to internal domain infrastructures.
The team also assessed AD CS configurations to identify potential privilege escalation opportunities. AD CS is a Windows service that is responsible for issuing digital certificates necessary for identifying users and computer accounts.
When certificate templates are not configured securely, attackers can obtain certificates representing privileged identities, which can then be used to authenticate without relying on the original password for authentication.
After a password reset or reimage of the initial compromised workstation, these certificates may remain useful unlike conventional credentials.
According to Microsoft, two certificates have been misused in the investigated incidents: ESC1 and ESC8. The first involved exploiting a misconfigured certificate template, which enabled attackers to obtain certificates for privileged accounts.
NTLM relay attacks were carried out against AD CS Web Enrollment using PetitPotam to force a domain controller to authenticate to an attacker-controlled system.
As demonstrated by these two incidents, even a seemingly routine interaction with IT support can be an entryway into identity-based attacks of greater scope. Neither intrusion exploited a Microsoft Teams vulnerability.
By exploiting weaknesses in the certificate infrastructure and employee deception, the attackers were able to move beyond the compromised workstations originally compromised.
ESC1 Abuse Leaves a Privileged Account Exposed
First, the attackers obtained authentication certificates for privileged accounts by exploiting a certificate template that was vulnerable to ESC1 attacks. As a result of Microsoft Defender's automated attack disruption, three highly privileged identities were affected in the initial wave, resulting in certificates for three highly privileged identities. Active sessions were disconnected, remote logons were blocked, SMB access was blocked, and accounts were restricted.
A privileged account was, however, excluded from the automated response and continued to be accessible about 90 minutes later. An additional phishing wave targeted 16 users and a second workstation. In addition to blocking more than 1,000 attempts to access SMB files and logons, Defender also blocked certificates for eight more additional privileged accounts obtained by the attackers.
Using one privileged certificate, the attackers have already authenticated with a domain controller and initiated a DCSync operation that replicates password data from Active Directory. In spite of Microsoft's claim that containment limited further activity, it was not disclosed to the public how much credential information was obtained.
An account excluded from automated containment provided another route to access the network.
Attackers accessed a file server and executed a version of Rclone disguised as SearchApp.exe, which copied files from a network share to an external SFTP server. However, Microsoft did not disclose the volume of data that was stolen.
PetitPotam and ESC8 Target Domain Controller Identity
Because the environment did not contain the ESC1 weakness, the second intrusion followed a different certificate-abuse path. Rather, the attackers used PetitPotam to initiate authentication between a domain controller and the system they were controlling from a domain controller.
This NTLM authentication was then relayed to an AD CS Web Enrollment endpoint susceptible to ESC8.
This enabled the attackers to request a certificate for the domain controller's machine account without knowing its password. As a result of using the issued certificate, the attacker was able to perform Kerberos PKINIT authentication, obtaining a ticket-granting ticket for the domain controller.
This converted relayed authentication into certificate-based access to a highly privileged machine identity.
It was detected that Microsoft Defender generated alerts regarding the ESC8 activity at the customer's site. The customer isolated the compromised workstation, after which Microsoft observed no further progression of the attack.
Microsoft Recommends Reviewing Certificate Configurations
This research highlights the importance of examining certificate infrastructure alongside endpoint and identity security. However, there is no specific patch available that addresses the entire attack chain because the intrusions relied on social engineering and configuration vulnerabilities rather than a software vulnerability.
An organization should verify unexpected IT support requests through internal channels, restrict communication from external Teams tenants, and limit access to approved tools for remote support. It is advisable for organizations to review certificate templates to ensure requester-supplied identity settings and unnecessary enrollment permissions are not used.
It is recommended that Microsoft implement HTTPS and Extended Protection for Authentication (EPA) for AD CS Web Enrollment, while disabling NTLM whenever operationally possible. In addition to enabling certificate auditing and utilizing Defender for identity posture assessments, Microsoft also suggests enabling certificate auditing and identifying exposed templates and secure enrollment endpoints with Defender.
The revokement of an unauthorized certificate and the publication of updated revocation information should occur when unauthorized certificates are discovered. A separate review of active tickets is necessary since revocation alone does not invalidate Kerberos tickets already issued.
Windows Server 2025 is configured to enable EPA for AD CS by default, while Windows Servers 2022 and 2019 need to be configured manually by administrators.
A manual response must also be assigned to accounts excluded from automated containment.
Detection Indicators and Investigation:
Microsoft published three SHA-256 hashes associated with the initial-access scripts:
JavaScript: 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17
Python: f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001
Python: 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7
Among the alerts included in the investigation are Microsoft Defender alerts regarding suspicious Teams activity, portable runtime execution, AD CS enumeration, certificate requests, NTLM relay, and Kerberos PKINIT. Microsoft provided four advanced hunting queries to assist in identifying related activity, though it is noted that each match requires further investigation.
The incidents were not attributed to known threat actors or disclosed by Microsoft when they occurred, nor was the date of the incident disclosed. Nonetheless, these cases demonstrate how help desk impersonation may result in certificate-based privilege escalation and demonstrate that incomplete containment may result in a compromised identity remaining accessible even after a substantial part of the attack has been contained.
.jpg "ESC1 and ESC8 Attacks Expose Active Directory Security Risks")
.jpg)
