Microsoft has described two intrusions that started with a fake IT support call on Teams and ended with attackers holding certificates for privileged accounts, with one case reaching DCSync and data theft. The lessons for defenders are about certificate services and containment gaps as much as phishing.
What happened
On 30 October 2026 Microsoft Threat Intelligence published its write-up of two hands-on-keyboard intrusions. Microsoft has not attributed them or named the victims. In both, the attackers contacted staff through Microsoft Teams messages and calls, posing as the internal IT or help desk team. They used onmicrosoft.com tenants themed on the target organisation’s name. Once a user had been convinced to accept help, the attacker asked them to start a remote session, mostly through Quick Assist, the remote assistance tool built into Windows.
No Teams vulnerability was involved, Microsoft says. Everything depended on a person approving a session and on weak Active Directory Certificate Services (AD CS) configuration. The cases then split: one abused a weak certificate template, known in the research community as ESC1, and the other relayed a domain controller’s authentication to a web enrolment endpoint, known as ESC8.
In the ESC1 case, the first wave reached three users and compromised one workstation. The attacker obtained certificates for three highly privileged accounts. Roughly 90 minutes later a second, larger wave went after 16 users, compromised a second machine and produced certificates for eight more privileged identities. Microsoft says a DCSync against a domain controller was performed within seconds of the attacker obtaining a privileged certificate. Defender’s automated attack disruption locked down most affected identities and blocked more than 1,000 later SMB file-access attempts, but one privileged account had been excluded from automated response. The attacker used it to log on to a file server and copy data to an external SFTP server using Rclone renamed as SearchApp.exe.
In the ESC8 case, the attacker coerced a domain controller into authenticating with PetitPotam, relayed that NTLM authentication to the AD CS Web Enrollment service and obtained a certificate from the Domain Controller template. That certificate was then used to request a Kerberos ticket-granting ticket (TGT) as the domain controller itself. Defender raised ESC8 alerts, the customer isolated the workstation, and Microsoft observed no further progress.
The technical picture
SOC teams can turn several details into detections. After the remote session started, an archive was dropped into the user’s Downloads folder and unpacked into a new folder under the profile with a name beginning “KB”, presumably so it would pass for a Windows update. The payload was then run with a portable runtime, which differed between deployments: Python, Bun (a JavaScript runtime) or Java. Discovery followed, with the workstation talking to domain controllers over LDAPS and SMB.
ESC1 is a template problem. When a certificate template that is valid for authentication allows the requester to supply the subject name, and enrolment is open to ordinary users, a low-privileged account can ask for a certificate in the name of a domain administrator, and the CA will issue it. ESC8 is a relay problem. An enrolment web endpoint that accepts NTLM without relay protection will issue a certificate to whoever it believes is authenticating. If a domain controller is coerced into authenticating to an attacker’s machine, that authentication can be passed on and turned into a domain controller certificate.
What makes both paths dangerous for responders is persistence. A certificate stays valid for its lifetime, whatever happens to the account’s password, and Microsoft notes that neither resetting the password nor reimaging the first machine revokes it. Revocation also leaves already-issued Kerberos tickets valid.
Why it matters for UK organisations
AD CS is everywhere in UK enterprise and public sector estates. It often went in years ago for Wi-Fi, VPN or smartcard authentication and has not been reviewed since, and ownership sits awkwardly between identity, infrastructure and security teams. Teams external access is also open in many tenants, so an “IT Service Desk” message from a stranger’s tenant arrives with little friction.
The incident response lessons carry regulatory weight too. Under UK GDPR, a reportable personal data breach must be notified to the ICO within 72 hours of the organisation becoming aware of it. Organisations in scope of NIS, and of the Cyber Security and Resilience Bill still going through Parliament, will increasingly need to show incidents were properly contained. Resetting passwords and rebuilding the first laptop while forged certificates stay valid is not containment.
Expert view
In my experience, AD CS is still one of the fastest routes from a domain user to domain admin in a typical internal test. Because these are configuration weaknesses rather than missing patches, scanners rarely flag them and a fully patched estate can still be wide open.
The detail I would put in front of any SOC manager is the excluded account. Exclusions from automated response exist for good reasons, such as break-glass and service accounts, but here one exclusion turned a largely contained incident into data theft. Microsoft’s own conclusion is that “partial identity containment can reduce attack activity”, which is true, but reducing is not stopping. Every exclusion should have a named owner, a documented manual action for incidents and a regular review.
The second lesson is speed. DCSync began seconds after certificate issuance. No analyst will beat that, so remove the misconfiguration rather than relying on catching it live. When we test help desk processes, the human verification step is usually the weakest link, and it costs almost nothing to fix.
What to do now
- Audit AD CS this week. Find authentication-capable templates that let the requester supply the subject, and those with broad enrolment rights. Tighten permissions or require CA manager approval (Cyber Essentials: secure configuration, user access control).
- Close the ESC8 path. Remove Web Enrollment and Certificate Enrollment Web Service where they are not needed. Where they are needed, enforce HTTPS with Extended Protection for Authentication and follow Microsoft’s KB5005413 guidance. Disable NTLM on enrolment services once Kerberos-only operation has been tested.
- Turn on CA auditing. Enable the Certification Services audit subcategory and the CA audit filter so certificate requests and issuance are logged, and forward those events to your SIEM.
- Hunt for the staging pattern. Look for Python, Bun or Java running scripts from KB-named folders under user profiles, and for those processes connecting to domain controllers on ports 80, 88, 445 or 636.
- Restrict Teams external access and remote support tools. Allow-list trusted external domains where you can. Remove or block Quick Assist if you have an approved remote support product, and block portable runtimes from user-writable paths with application control (Cyber Essentials: malware protection).
- Fix the verification process. Staff should confirm any unsolicited support contact through a known internal channel before accepting a call or remote session.
- Update incident playbooks. Include certificate revocation, CRL publication and Kerberos session review as standard containment steps, and review every exclusion from automated response.
Bottom line
A convincing Teams call opened the door, but forgotten certificate templates and an unprotected enrolment service handed over the keys. Organisations that run AD CS should treat this report as a prompt to audit it now, before a fake help desk call does the audit for them.
Sources
- Microsoft Security Blog: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
- Truesec: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS) – ADV210003 – KB5005413 – PetitPotam
- Infosecurity Magazine: Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
