Microsoft details help desk impersonation and AD CS attacks

Microsoft Threat Intelligence investigated two human-operated intrusions in which threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel, social engineering users into granting interactive remote access primarily through Quick Assist.

After gaining access, the attackers staged portable runtimes (Python, Bun, or Java) from user-writable locations, performed host and network discovery, and evaluated Active Directory Certificate Services (AD CS) for certificate-based authentication paths.

The incidents diverged at the certificate layer: Case 1 leveraged an ESC1-vulnerable certificate template to obtain authentication certificates for privileged accounts and carried out a DCSync; Case 2 used PetitPotam to coerce domain-controller authentication and relayed NTLM to AD CS Web Enrollment via ESC8 to obtain a domain-controller certificate for certificate-based Kerberos authentication (PKINIT).

In Case 1, after an initial compromised workstation and three privileged certificates, an excluded privileged account remained usable and was later used for data exfiltration, with more than 1,000 SMB access attempts blocked by Defender disruptions. In Case 2, Defender alerts led to customer-led isolation of the involved workstation; no further progression was observed afterward.

The blog emphasises that the same collaboration, endpoint, identity, and certificate signals underpin both paths, but outcomes differed due to containment coverage and the handling of exclusions. Investigators are advised to reconstruct the chain across collaboration, endpoint, identity, and certificate systems, correlate certificate events with AD CS activity, and apply targeted containment and auditing to AD CS endpoints and certificate issuance.