Teams help-desk lures led to AD CS ESC1 and ESC8 abuse
Original title: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Two unattributed intrusions used Quick Assist; one reached DCSync and exfiltration after a privileged identity was excluded from containment.
Microsoft Threat Intelligence investigated two human-operated intrusions that began with Teams messages and calls impersonating IT support. Users approved remote access, mainly through Quick Assist; attackers then staged portable Python, Bun, or Java runtimes and looked for Active Directory Certificate Services paths. Case 1 abused an ESC1 template to get privileged certificates and performed DCSync; a containment exclusion later allowed data exfiltration. Case 2 used PetitPotam to relay a domain controller’s NTLM authentication to AD CS Web Enrollment (ESC8). Microsoft said Teams itself was not exploited.
Unconfirmed: Microsoft did not attribute the activity to a named threat actor.
- Case 1 obtained authentication certificates for privileged accounts, then ran DCSync.
- Defender disruption worked in Case 1 except for one excluded privileged identity.
- Case 2 used the domain-controller certificate for PKINIT; the workstation was isolated.
- External onmicrosoft.com tenants and support display names were used.
- Resetting a password does not revoke an already issued certificate.
Impact: Privileged certificates, DCSync, and data exfiltration
- 1.Keep every compromised identity eligible for automated containment.
- 2.Remove authentication templates that allow requester-supplied identity.
- 3.Enable relay protections on AD CS Web Enrollment.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1219 Remote Access SoftwareT1649 Steal or Forge Authentication CertificatesT1003.006 DCSyncT1187 Forced Authentication
- Vendors
- Microsoft
- Malware
- PetitPotam
From the original article
12 min read at microsoft.com
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths appeared first on Microsoft Security Blog.
By Microsoft Security Research, Sagar Patil, Jesse Birch and Tal Tzhori · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.