From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

What it is

Microsoft Threat Intelligence (30 October 2026) describes two human-operated intrusions, not attributed to any named actor. Both started with Teams messages and calls impersonating IT support, which led a user to open Quick Assist. They then diverged at Active Directory Certificate Services (AD CS). No Teams vulnerability was involved. The abuse relied on social engineering and permissive AD CS configuration.

How it works

flowchart TD
    A[Teams help desk impersonation] --> B[Quick Assist session]
    B --> C[Archive to Downloads, extract to KB-prefixed folder]
    C --> D[Portable Bun or Java runs, discovery, AD CS assessment]
    D --> E{AD CS weakness}
    E -->|ESC1 template| F[Certs for privileged accounts, DCSync]
    E -->|ESC8 Web Enrollment| G[PetitPotam relay, DC cert, PKINIT]
    F --> H[Excluded account used for Rclone exfil]
    G --> I[Customer isolates workstation]

The shared foothold: an archive is placed during the remote session and extracted into a new KB-prefixed folder under the user profile. A portable runtime then launches the payload. In one variant a renamed Bun executable kept its Bun version metadata. In another, a staged Java runtime ran a Java source file. The payload ran Windows version queries, ipconfig /all and tasklist, and the workstation connected to domain infrastructure over LDAPS and SMB.

Case 1 (ESC1): the attacker obtained certificates for three privileged accounts in a first wave. About 90 minutes later a second wave hit 16 users and yielded eight more privileged certificates. Defender attack disruption restricted the covered identities and blocked more than 1,000 SMB file-access attempts. DCSync still began within seconds of the first privileged certificate. One privileged account was excluded from automated response. The attacker used it to reach a file server and ran a renamed Rclone (SearchApp.exe) to copy data to an external SFTP destination. The run used 20 concurrent transfers and selected files up to three years old.

Case 2 (ESC8): ESC1 was not available. The attacker used PetitPotam over EFSRPC to make a domain controller authenticate to an attacker system. They relayed that NTLM authentication to AD CS Web Enrollment (/certsrv) and requested a certificate from the Domain Controller template. They then used it for PKINIT to get a TGT for the domain controller. Defender raised ESC8 alerts, the customer isolated the workstation, and no further progression was seen.

Preconditions / Affected

• ESC1: an authentication-capable template that allows requester-supplied identity, with broad enrollment rights and weak issuance controls.
• ESC8: a Web Enrollment endpoint that accepts NTLM without relay protection.
• Users able to receive external Teams contact and approve remote-support sessions.

What to do

Harden AD CS:

• Follow KB5005413 (https://support.microsoft.com/help/5005413) for NTLM relay mitigation.
• Review authentication-capable templates for requester-supplied subject, broad enrollment and weak issuance requirements. Require approval where appropriate.
• Remove Web Enrollment and Certificate Enrollment Web Service endpoints that are not needed.
• Require HTTPS and enforce Extended Protection for Authentication (EPA), which provides the channel binding that resists relay. Disable NTLM on enrollment services where feasible.
• Use Defender for Identity AD CS posture assessments to find ESC1 template exposure and ESC8 IIS endpoints.
• Enable the Certification Services audit subcategory (success and failure) and set the CA audit filter to record request and issuance.

Respond:

• Revoke unauthorized certificates by serial number and thumbprint, and publish updated revocation data.
• Review Kerberos tickets separately. Revocation does not invalidate TGTs or service tickets already issued, and a password reset or reimage does not revoke issued certificates.
• Audit containment exclusions before and during response, and assign a manual action for any excluded account.

Reduce exposure:

• Limit Teams external access and federation to business needs.
• Restrict remote-support tools to approved ones.
• Apply application control to portable runtimes in user-writable paths. Do not assume script-host attack surface reduction rules cover Bun or Java.

Hunting queries from the post:

CloudAppEvents
| where Timestamp > ago(7d)
| where Application == "Microsoft Teams"
| where
    (ActionType == "ChatCreated" and IsExternalUser == true)
    or ActionType in~ (
        "TeamsImpersonationDetected",
        "SecurityRiskInCallDetected")
| order by Timestamp desc

DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName =~ "bun.exe"
    or FileName in~ ("bun.exe", "java.exe", "javaw.exe")
| where ProcessCommandLine contains ".js"
    or ProcessCommandLine contains ".java"
| where FolderPath matches regex
    @"(?i)\\AppData\\Roaming\\KB[0-9]+\\"
| order by Timestamp desc

AlertInfo
| where Timestamp > ago(7d)
| where
    Title contains "NTLM relay"
    or Title contains "Certificate Services"
    or Title contains "PKINIT"
    or Title contains "Kerberos ticket request"
| join kind=inner (
    AlertEvidence
    | where Timestamp > ago(7d)
) on AlertId

A fourth query in the post covers DeviceNetworkEvents from the staged runtime on ports 80, 445, 636 and 88. A useful ESC8 pivot is a domain controller machine account authenticating to AD CS from a different device. Correlate it with the Web Enrollment request, the CA issuance record and later PKINIT.

Caveats

• File names are weak indicators. The post says to key on a portable runtime launched from a new user-writable folder after an unexpected remote session.
• Matches from the queries need investigation. Field availability and alert names depend on tenant configuration and sensors.
• The post does not establish name-resolution poisoning in Case 2. The relay is inferred from CA telemetry.
• The post gives no indicator values in the text fetched.