From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Intrusions leveraged human deception through Microsoft Teams to gain initial access, wherein threat actors impersonated IT or help desk staff to convince users to grant remote access via Quick Assist. Once established in the victim's environment, actors deployed portable runtimes like Python, Bun, or Java for system and network discovery. The attacks differed at the certificate abuse stage: Case 1 exploited an ESC1-vulnerable template to elevate privileges and execute DCSync, while Case 2 utilized PetitPotam to relay domain controller authentication to AD CS Web Enrollment via ESC8, ultimately obtaining a certificate used for PKINIT Kerberos authentication.
The significance lies in how simple social engineering can lead to durable, certificate-backed access paths into core infrastructure. Incident response varied; Microsoft Defender successfully contained activity in both cases, but Case 1 highlighted the danger of containment exclusions permitting ongoing data exfiltration via an untouched privileged identity. This activity depended entirely on insecure AD CS configurations and user interaction, not vulnerabilities within Teams itself.

Threat actors used Microsoft Teams messages and calls to socially engineer users into granting interactive remote access primarily through Quick Assist.
Attackers staged portable Python, Bun, or Java runtimes after gaining a remote session.
In Case 1, the actor abused an Enterprise CA Security Configuration 1 (ESC1) vulnerable template to obtain privileged account authentication certificates and performed DCSync.
In Case 2, the actor used PetitPotam, relaying NTLM authentication from a domain controller to AD CS Web Enrollment (ESC8).
Case 2 resulted in obtaining a domain-controller certificate and using it for PKINIT Kerberos authentication.
Microsoft Defender attack disruption restricted covered identities in Case 1, but an excluded privileged identity remained usable for data exfiltration.
In Case 2, Defender generated ESC8-related alerts, prompting customer isolation of the workstation without further observed progression.
The activity relied on social engineering and insecure or overly permissive AD CS configurations rather than a Microsoft Teams vulnerability.
File discovery involved queries to Windows version info, network configuration, and processes, alongside SMB/LDAPS connections.

This narrative presents a clear case study demonstrating the fragility of enterprise trust boundaries when social engineering meets misconfigured Certificate Authority infrastructure. The strongest interpretation suggests that the initial vector—human compliance via Teams—is less sophisticated than the subsequent credential abuse techniques (ESC1 vs. ESC8), suggesting layered defense failure across behavioral, configuration, and identity layers. Both branches reveal a critical assumption in many environments: the persistence of issued credentials or certificates beyond the scope of an active login session. The impact is magnified because successful certificate issuance transforms a transient access event into long-lived, cryptographically backed privilege.
The underlying pattern is one of *Leveraged Trust Exploitation*. Attackers are not breaking cryptographic primitives; they are exploiting poorly segmented configuration defaults (ESC1's broad permissions or ESC8's lack of relay protection) to force valid identity systems (Domain Controller authentication, Enterprise CA issuance) to operate outside their intended safety envelope. The differing response outcomes—containment success versus containment bypass leading to exfiltration—highlight that security controls are only as strong as their completeness; incomplete scoping in automation is equivalent to an explicit vulnerability.
A key question for cognitive sovereignty here is: How often does the necessity of "allowance" (e.g., permitting certain legacy authentication flows, necessary administrative exceptions) create a pathway so enticingly valuable to an attacker that its existence becomes functionally identical to an open door? Furthermore, if endpoint detection covers execution paths like Bun/Java but misses deep AD CS policy auditing or specific NTLM relay telemetry, where does the actual failure point of organizational resilience reside—in visibility gaps or in systemic reliance on implicit trust assertions within core services?
Patterns detected: none