Fake Teams IT help desk sessions abused AD CS for domain access
Two Microsoft-disclosed intrusions used Quick Assist plus ESC1 or ESC8, then DCSync and Rclone in one case.
74
Product
Active Directory Certificate Services
- Mentions · 7d2
- Mentions · 30d4
- All mentions6
- First seenAug 26, 2026
- Last mentioned7h ago
Timeline
6 articles · newest firstTeams help-desk lures led to AD CS ESC1 and ESC8 abuse
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
73
Patch Tuesday - October 2026
Microsoft's October 2026 Patch Tuesday fixes dozens of Windows flaws, including AD FS spoofing and Desktop Window Manager privilege bugs.
58
Top 10 Best Certificate Lifecycle Management (PKI) Tools in 2026 [Ranked & Scored]
A 2026 PKI ranking puts DigiCert first, ahead of Keyfactor and Venafi, citing 47-day TLS lifetimes.
18
Privilege escalation from IIS AppPool to NT Authority/SYSTEM
A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.
42
CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.
72
Related CVEs
by mentions- SQL injection privilege escalation in Microsoft Configuration Manager
- Type confusion privilege escalation in Desktop Window Manager
- Use-after-free privilege escalation in Windows Clipboard User Service
- Local privilege escalation via out-of-bounds read in Windows DWM
- Improper certificate validation in Microsoft AD FS
- Race-condition privilege escalation in Microsoft AD CS
- Use-after-free local privilege escalation in Windows Cdpsvc
- Double-free local privilege escalation in Windows Cdpsvc
- Weak authentication bypass in Microsoft AD FS
- Local buffer over-read in Windows Desktop Window Manager
Appears with
- Microsoftvendor · 5
- Microsoft Teamsproduct · 2
- Quick Assistproduct · 2
- PetitPotammalware · 2
- SSL.comvendor · 1
- Smallstepvendor · 1
- EJBCAproduct · 1
- Organization Avictim · 1
- Active Directory Federation Servicesproduct · 1
- Trust Lifecycle Managerproduct · 1
- Windowsproduct · 1
- Desktop Window Managerproduct · 1
- Azure Active Directoryproduct · 1
- SCCMproduct · 1
- GlobalSignvendor · 1
- DigiCertvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.