Attackers Pose as IT Help Desk on Teams, Abuse AD CS (ESC1, ESC8) for Domain Privilege Escalation in Two Intrusions
Microsoft disclosed on October 30, 2026 two intrusions in which operators impersonated IT help desk staff over Microsoft Teams, persuaded victims to start Quick Assist, and then abused Active Directory Certificate Services (AD CS) to obtain certificates for privileged identities. No Teams vulnerability was exploited; the activity relied on social engineering and insecure AD CS configurations. Microsoft has not attributed the activity to a specific threat actor. In the first intrusion, the attackers obtained certificates for 11 privileged accounts, performed DCSync, and exfiltrated files with Rclone. In the second, they used PetitPotam and NTLM relay to obtain a domain-controller certificate before the customer isolated the host.
Entenda a falha
A vulnerabilidade
No CVE and no Teams flaw. The attackers abused insecure AD CS configurations after social engineering. ESC1: a certificate template with broad enrollment permissions, requester-supplied identity information and weak issuance controls lets a low-privileged account request authentication certificates for privileged identities. ESC8: AD CS Web Enrollment is insufficiently protected against NTLM relay. The attacker needs a foothold on a workstation, obtained by tricking a user into starting Quick Assist, plus network reach to the domain infrastructure. In return they get certificates for privileged users or a domain controller. The articles give no affected or fixed versions, because this is a configuration problem.
Como funciona
The operator contacts an employee on Teams, posing as help desk, and gets them to launch Quick Assist and share the connection code. From that session they drop archives, run portable Python, Bun or Java runtimes, and enumerate the host and the certificate services over LDAPS and SMB. In the ESC1 case, the vulnerable template accepts the identity the requester supplies and issues a certificate for a privileged account, which is then used to authenticate and run DCSync. In the ESC8 case, PetitPotam over EFSRPC forces a domain controller to authenticate, the NTLM authentication is relayed to AD CS Web Enrollment, and the resulting domain-controller certificate is used with Kerberos PKINIT to get a TGT for the machine identity.
Por que é vulnerável
For ESC1, the template trusts identity data from the requester and does not restrict who may enroll or add enough issuance controls. For ESC8, the Web Enrollment endpoint accepts relayed NTLM authentication because it lacks protections such as HTTPS and Extended Protection for Authentication, and NTLM is still enabled. Social engineering supplies the initial access. Microsoft's guidance is to fix these settings: review enrollment permissions and templates, enforce HTTPS and EPA, and disable NTLM where feasible. The articles do not say why the misconfigurations went unnoticed. One account excluded from automated containment also stayed usable and helped data theft.
Como foi descoberta
Microsoft disclosed the two intrusions on October 30, 2026, based on activity it observed, with Microsoft Defender alerting and blocking part of it. Microsoft has not attributed the activity to a specific threat actor. The articles do not say who the victims were or how the weak configurations were first identified.
Explicação gerada por IA a partir da matéria e dos artigos, em 31/10/2026 07:16.
Detalhes técnicos
- Attackers contacted employees via Teams messages and calls using organization-themed tenant names and support-style display names, then had victims launch Quick Assist and share connection codes.
- After access, archives were moved to Downloads and payloads extracted into KB-prefixed directories under user profiles. Portable Python, Bun or Java runtimes were launched to perform host discovery and assess certificate services, with LDAPS and SMB connections to domain infrastructure.
- Intrusion 1 (ESC1): a certificate template with broad enrollment permissions, requester-supplied identity information and weak issuance controls let a low-privileged account request authentication certificates for privileged identities. The first wave targeted 3 users, compromised one workstation and yielded certificates for 3 highly privileged accounts. About 90 minutes after disruption, a second wave targeted 16 users, compromised another workstation and yielded 8 more privileged certificates.
- Microsoft Defender blocked more than 1,000 subsequent SMB file-access attempts and logons, but the attackers ran DCSync within seconds of getting one privileged certificate. One privileged account excluded from automated containment stayed usable and was used to access a file server and run Rclone renamed SearchApp.exe, copying files to an external SFTP destination.
- Intrusion 2 (ESC8): attackers used PetitPotam over EFSRPC to coerce domain-controller authentication, relayed the NTLM authentication to insufficiently protected AD CS Web Enrollment, obtained a domain-controller certificate, and used Kerberos PKINIT to get a TGT for the machine identity. The customer isolated the workstation after Defender alerts, and Microsoft observed no further progression.
Remediação
- Restrict external Teams access, verify unsolicited support requests, and control execution of portable runtimes.
- Review certificate enrollment permissions and templates; enforce HTTPS and Extended Protection for Authentication on enrollment endpoints; disable NTLM where feasible.
- Revoke unauthorized certificates and separately investigate Kerberos tickets: password resets do not revoke issued certificates, and certificate revocation does not invalidate existing tickets.
- Review accounts excluded from automated containment.
Linha do tempo
-
Attackers Pose as IT Help Desk on Teams, Abuse AD CS (ESC1, ESC8) for Domain Privilege Escalation in Two Intrusions
ler a análise desta fonte ocultar
Microsoft disclosed on October 30, 2026 two intrusions in which operators impersonated IT help desk staff over Microsoft Teams, persuaded victims to start Quick Assist, and then abused Active Directory Certificate Services (AD CS) to obtain certificates for privileged identities. No Teams vulnerability was exploited; the activity relied on social engineering and insecure AD CS configurations. Microsoft has not attributed the activity to a specific threat actor. In the first intrusion, the attackers obtained certificates for 11 privileged accounts, performed DCSync, and exfiltrated files with Rclone. In the second, they used PetitPotam and NTLM relay to obtain a domain-controller certificate before the customer isolated the host.
Technical Details
- Attackers contacted employees via Teams messages and calls using organization-themed tenant names and support-style display names, then had victims launch Quick Assist and share connection codes.
- After access, archives were moved to Downloads and payloads extracted into KB-prefixed directories under user profiles. Portable Python, Bun or Java runtimes were launched to perform host discovery and assess certificate services, with LDAPS and SMB connections to domain infrastructure.
- Intrusion 1 (ESC1): a certificate template with broad enrollment permissions, requester-supplied identity information and weak issuance controls let a low-privileged account request authentication certificates for privileged identities. The first wave targeted 3 users, compromised one workstation and yielded certificates for 3 highly privileged accounts. About 90 minutes after disruption, a second wave targeted 16 users, compromised another workstation and yielded 8 more privileged certificates.
- Microsoft Defender blocked more than 1,000 subsequent SMB file-access attempts and logons, but the attackers ran DCSync within seconds of getting one privileged certificate. One privileged account excluded from automated containment stayed usable and was used to access a file server and run Rclone renamed SearchApp.exe, copying files to an external SFTP destination.
- Intrusion 2 (ESC8): attackers used PetitPotam over EFSRPC to coerce domain-controller authentication, relayed the NTLM authentication to insufficiently protected AD CS Web Enrollment, obtained a domain-controller certificate, and used Kerberos PKINIT to get a TGT for the machine identity. The customer isolated the workstation after Defender alerts, and Microsoft observed no further progression.
Remediation
- Restrict external Teams access, verify unsolicited support requests, and control execution of portable runtimes.
- Review certificate enrollment permissions and templates; enforce HTTPS and Extended Protection for Authentication on enrollment endpoints; disable NTLM where feasible.
- Revoke unauthorized certificates and separately investigate Kerberos tickets: password resets do not revoke issued certificates, and certificate revocation does not invalidate existing tickets.
- Review accounts excluded from automated containment.