Teams help desk impersonation leads to AD CS ESC1 and ESC8 certificate abuse in two intrusions
THREAT ACTORActive Directory Certificate Servicesredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Microsoft Threat Intelligence investigated two human-operated intrusions that began with Teams messages and calls impersonating help desk staff, leading users to approve Quick Assist sessions. The attackers staged portable Python, Bun or Java runtimes, performed discovery and probed AD CS. In Case 1 an ESC1-vulnerable template gave certificates for privileged accounts and DCSync. In Case 2 PetitPotam and an ESC8 relay gave a domain controller certificate.
For IT people · Written by AI from 1 source · Wrong?
What to do
- No action needed: this one is for your information.
General advice for this kind of story
Full story timeline · 1 update
Who reported · 1 outlet
Microsoft Security Blog
Who and what is in it
Companies