Microsoft Defender
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Named in breach reports by Cyber Security NewsAttackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
- Activity reported by Microsoft Security BlogTeams help desk impersonation leads to AD CS ESC1 and ESC8 certificate abuse in two intrusions
Recent news
Attackers impersonate IT help desks on Microsoft Teams to gain remote access and abuse certificate services
Microsoft investigated two intrusions in which attackers impersonated help desk staff via Teams chats and calls and got users to approve Quick Assist remote-support sessions. The attackers dropped portable Python, Bun or Java runtimes and staged scripts, then abused weak Active Directory Certificate Services configurations to obtain certificates for privileged accounts. In one case an excluded privileged account was used to exfiltrate files with Rclone to an external SFTP server, and Microsoft Defender blocked over 1,000 subsequent SMB file-access attempts.
Teams help desk impersonation leads to AD CS ESC1 and ESC8 certificate abuse in two intrusions
Microsoft Threat Intelligence investigated two human-operated intrusions that began with Teams messages and calls impersonating help desk staff, leading users to approve Quick Assist sessions. The attackers staged portable Python, Bun or Java runtimes, performed discovery and probed AD CS. In Case 1 an ESC1-vulnerable template gave certificates for privileged accounts and DCSync. In Case 2 PetitPotam and an ESC8 relay gave a domain controller certificate.