Attackers Impersonate IT Support via Teams to Abuse AD CS for Privileged Access
Threat actors are leveraging Microsoft Teams to impersonate IT support, tricking users into granting remote access and then exploiting Active Directory Certificate Services (AD CS) misconfigurations for privileged certificates.
Microsoft Threat Intelligence has detailed two recent intrusions where attackers successfully impersonated IT help desk personnel using Microsoft Teams to gain remote access to victim environments. The attackers primarily used social engineering tactics, including Teams messages and calls, to persuade users to grant them interactive remote sessions, often via Quick Assist. Once inside, they deployed portable runtimes and conducted reconnaissance to identify network structures and assess Active Directory Certificate Services (AD CS) for potential exploitation.
While both incidents began with the same social engineering and remote access vector, they diverged in their methods of abusing AD CS. In the first case, attackers exploited a misconfiguration known as ESC1 (Enterprise CA Security Configuration 1) in a certificate template. This allowed them to enroll for authentication certificates under privileged account identities, which they then used to perform DCSync attacks, a technique that can exfiltrate password hashes.
The second intrusion involved the use of PetitPotam, a known technique that tricks a Windows server into authenticating to an attacker-controlled system. The attackers relayed this authentication to AD CS Web Enrollment (ESC8), a process that lacks adequate relay protections. By doing so, they were able to obtain a certificate for a domain controller account, which they then used for certificate-based Kerberos authentication (PKINIT), effectively gaining privileged access.
These attack chains are particularly concerning because a user-approved remote session can be leveraged to establish persistent, certificate-backed access to critical identities and domain infrastructure. Unlike password compromises, certificates issued through these methods remain valid even if the original user's password is reset or the compromised machine is reimaged, posing a significant challenge for remediation.
Microsoft Defender's automated attack disruption capabilities played a role in mitigating the impact. In Case 1, it restricted covered identities and blocked substantial follow-on activity. However, a privileged identity that was excluded from automated containment remained usable by the attacker, ultimately supporting data exfiltration. In Case 2, Defender generated alerts for the ESC8 activity, prompting the customer to isolate the affected workstation and halt further progression.
The techniques observed do not exploit vulnerabilities in Microsoft Teams itself but rather rely on social engineering and insecure or overly permissive configurations within AD CS. The attackers' use of portable runtimes like Python, Bun, or Java, which can be renamed and executed from user-writable locations, further aids their stealth and evasion efforts.
Microsoft has provided actionable investigation methods, mitigation recommendations, and advanced hunting queries to help defenders identify and disrupt these types of access paths. The activity described has not been attributed to a specific threat actor, highlighting the broad applicability of these techniques to various adversaries.
This report underscores the critical importance of securing AD CS configurations, implementing robust endpoint detection and response, and training users to recognize and report suspicious IT support requests, especially those initiated through communication platforms like Teams.