Teams help desk impersonation leads to AD CS ESC1 and ESC8 certificate abuse in two intrusions

Both cases used Teams help desk impersonation, Quick Assist, archive staging, portable runtimes and AD CS discovery before diverging. Case 1 abused an ESC1 template (requester-supplied identity, broad enrollment) to obtain privileged certificates and run DCSync. Case 2 used PetitPotam to coerce domain controller NTLM authentication, relayed it to AD CS Web Enrollment (ESC8), and used the certificate for PKINIT. Issued certificates and Kerberos tickets survive password resets and reimaging. A privileged identity excluded from Defender attack disruption stayed usable and later supported exfiltration, so defenders should review exclusions, template permissions and relay protections on enrollment endpoints. No CVE IDs are given.

For security analysts · Written by AI from 1 source · Wrong?