Microsoft: Teams help-desk impostors abuse AD CS for domain takeover

Microsoft has published a breakdown of two intrusions that begin the same way — an attacker posing as IT support on Microsoft Teams, talking a user into Quick Assist — and then diverge into two classic Active Directory Certificate Services (AD CS) abuse paths: ESC1 and ESC8. There is no patch, because the weaknesses are configuration, not code. Microsoft ties the activity to no known group.

The primary is Microsoft Threat Intelligence's October 30 report; The Hacker News brought it into today's cycle.

The entry point

Attackers contacted employees over Teams and by phone, often from outside tenants with support-themed names, and persuaded them to open Quick Assist and read back the connection code — handing over a remote session. An archive was dropped into Downloads, unpacked into a folder styled to look like a Windows update, and run with a portable Python, Bun, or Java runtime to dodge software controls.

Two certificate paths

Case 1 — ESC1. A misconfigured certificate template let a low-privileged user request certificates for privileged accounts. The attacker ran DCSync, then used a renamed Rclone to move data from a file share to an external SFTP server. One privileged account had been excluded from Defender's automatic containment — and that was the account used for exfiltration.

Case 2 — ESC8. With no vulnerable template available, the attacker used PetitPotam to coerce a domain controller into authenticating, relayed that NTLM to the AD CS web enrollment endpoint, obtained a domain-controller certificate, and used PKINIT to get a ticket-granting ticket. Defender ESC8 alerts and workstation isolation stopped it before it progressed.

The persistence point Microsoft stresses: a certificate keeps working after a password reset or a machine reimage. Revoking it also does not cancel Kerberos tickets already issued.

Detection

Microsoft published IOCs (file hashes for the initial-access scripts), Defender alert mappings across Teams, endpoint and identity, and four advanced-hunting queries in the report. Pull them from the source rather than a paraphrase — the IOC and hunting section is in the blog post. We're deliberately not reproducing the hashes here; copy them from Microsoft to avoid a transcription error in your detections.

Action checklist

1. Lock down remote-support tooling. Allow only approved tools; block or restrict Quick Assist where it isn't needed, and verify any unexpected support request through a known internal channel.
2. Restrict external Teams tenants so unknown outside orgs can't cold-message staff with support-themed names.
3. Audit certificate templates for ESC1: any template that lets the requester name the account, or that is open to too many enrollees, is a domain-takeover primitive.
4. Harden AD CS web enrollment against ESC8: require HTTPS and Extended Protection for Authentication (EPA), disable NTLM there where possible, and apply the mitigations in KB5005413.
5. Enable certificate auditing, and treat any account excluded from automatic containment as a deliberate exception that needs a manual response plan.

Context

AD CS abuse via ESC1/ESC8 is years old and well documented, yet it keeps landing because the misconfigurations are quiet defaults in large environments and the help-desk social-engineering front end — Teams plus Quick Assist — keeps working. The through-line with the Storm-1811 Quick Assist campaigns is clear: the certificate layer is where a workstation compromise becomes a domain one, and a password reset won't walk it back.