Teams help desk impersonation enabled AD CS domain attacks

Two intrusions investigated by Microsoft Threat Intelligence began with help desk impersonation on Teams, using fake IT staff with support-style display names to persuade users to start Quick Assist and share the remote access code. Once the session was established, the attackers dropped an archive into Downloads, unpacked it in a folder named like a Windows update, and launched code via portable runtimes such as Python, Bun, or Java.

They then mapped the host and network and probed Active Directory Certificate Services (AD CS). Microsoft emphasises that no Teams vulnerability was exploited; the attacks relied on social engineering and permissive AD CS configurations. In the first organisation, a flawed certificate template (ESC1) allowed a low-privilege user to request certificates for identities including admins.

The first wave targeted three users on one workstation, yielding certificates for three highly privileged accounts; a second wave 90 minutes later targeted 16 more users with certificates for eight additional privileged accounts.

Shortly after, the attackers used DCSync to exfiltrate credential data from a domain controller, with Defender halting more than 1,000 subsequent file-access attempts, though one privileged account remained usable to reach a file server and copy data to an external SFTP site using a renamed Rclone.

In the second case, ESC1 did not exist, so the attackers used PetitPotam to coerce a domain controller to authenticate to a system they controlled, then relayed that login to the AD CS web enrollment service in an ESC8 technique. This allowed them to obtain a certificate for the domain controller itself and to request a Kerberos ticket for that identity. Defender produced ESC8 alerts and the customer isolated the workstation; Microsoft observed no further activity.

Microsoft states the activity is not attributed to a specific threat actor, with attackers using onmicrosoft[.]com tenant names that mimic the targets. The report notes that the key danger of AD CS abuse is that issued certificates and Kerberos tickets can outlive password resets or device reimaging, underscoring the need for full containment and timely revocation when appropriate.

Recommendations include tightening user training for unexpected Teams calls, restricting or disabling Quick Assist, auditing certificates and preventing identity self-service in templates, enabling relay protections on AD CS web enrollment or disabling it if unused, revoking suspicious certificates and reviewing Kerberos tickets after incidents, avoiding excluding privileged accounts from automated containment, and flagging portable runtimes launched from user folders after remote sessions.