cyber.hendryadrian.com
Threat Research · microsoft.com

Microsoft Details Teams Support-Impersonation Intrusions Using AD CS ESC1 and ESC8

· Original article ↗

Summary

Microsoft describes two intrusions starting with Teams help-desk impersonation and Quick Assist access, then diverging into AD CS ESC1 certificate abuse or PetitPotam/ESC8 NTLM relay. One led to DCSync and data exfiltration; isolation halted the other.

Key points

  • Both intrusions began with Teams messages or calls impersonating support staff and users granting remote access, primarily through Quick Assist; attackers then staged portable runtimes to execute scripts and discover hosts.
  • In Case 1, attackers abused an ESC1-vulnerable certificate template to obtain certificates for privileged accounts and performed DCSync.
  • Automated containment restricted many compromised identities, but an excluded privileged account remained usable and was later used to access a file server and exfiltrate data with a renamed Rclone executable.
  • In Case 2, PetitPotam coerced domain-controller authentication; attackers relayed NTLM to AD CS Web Enrollment through ESC8, obtained a domain-controller certificate, and used it for Kerberos PKINIT.
  • After Microsoft Defender alerts in Case 2, the customer isolated the associated workstation; no further progression was observed.
  • Microsoft recommends correlating Teams, endpoint, identity, certificate-authority, and Kerberos records; reviewing AD CS templates and relay protections; revoking unauthorized certificates; and separately reviewing active Kerberos tickets.

Article Details

Attack Vectors
  • In two unattributed intrusions, attackers impersonated IT or help desk personnel through Microsoft Teams messages and calls, persuading users to grant interactive remote access, primarily through Quick Assist.
  • After access, attackers transferred and extracted archives into user-writable staging directories and ran attacker-controlled scripts using portable Python, Bun, or Java runtimes.
  • In one case, attackers abused an ESC1-vulnerable AD CS certificate template to obtain authentication certificates for privileged accounts and performed DCSync.
  • In the other case, attackers used PetitPotam over EFSRPC to coerce domain-controller authentication, relayed NTLM to AD CS Web Enrollment through ESC8, and used the issued certificate for PKINIT.
  • An attacker used a renamed copy of Rclone to copy files from a file-server share to an external SFTP destination.
Defensive Notes
  • Require users to verify unsolicited support requests through a known internal channel before starting remote-control sessions; review Teams external-access and federation policies.
  • Restrict remote-support software to approved products, operators, and workflows. Alert on archive extraction, interpreter creation, and script execution from user-writable paths after remote sessions.
  • Use application control to restrict unapproved portable runtimes and script execution from user-writable locations; assess executable signer, original filename, metadata, path, parent process, and behavior.
  • Harden AD CS templates by removing unnecessary enrollment rights, restricting requester-supplied subject information, and requiring appropriate issuance controls.
  • Protect AD CS enrollment endpoints with HTTPS and Extended Protection for Authentication; disable NTLM where operationally feasible and remove unnecessary enrollment endpoints.
  • Correlate EFSRPC activity, domain-controller outbound authentication, Web Enrollment requests, CA issuance records, and subsequent PKINIT activity.
  • Enable certificate auditing, preserve CA and Web Enrollment records, revoke unauthorized certificates, and review Kerberos tickets separately because revocation does not invalidate already-issued tickets.
  • Ensure every compromised identity and device is eligible for containment; review response exclusions and assign verified manual containment actions when automation cannot apply.

Indicators of compromise

TypeIndicatorContext
SHA25606c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7SHA-256 listed in the article's IOC table as an initial-access Python script.
SHA25685b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17SHA-256 listed in the article's IOC table as an initial-access Java script.
SHA256f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001SHA-256 listed in the article's IOC table as an initial-access Python script.

MITRE ATT&CK

T1003.006 · DCSyncIn the ESC1 case, the attacker used a privileged certificate to authenticate to a domain controller and perform DCSync.T1016 · System Network Configuration DiscoveryA staged runtime initiated ipconfig /all to discover network configuration.T1036 · MasqueradingA Bun executable was renamed, and update-themed staging was used.T1057 · Process DiscoveryA staged runtime initiated tasklist to enumerate running processes.T1059.003 · Windows Command ShellShell commands staged archives, launched runtimes, and initiated native discovery commands.T1059.007 · JavaScriptBun was used to execute attacker-controlled JavaScript from a staged, user-writable location.T1082 · System Information DiscoveryA staged runtime initiated a Windows version information query.T1105 · Ingress Tool TransferAn archive was transferred to a victim workstation during the remote session and extracted for runtime-based execution.T1219 · Remote Access ToolsAttackers obtained interactive access through user-approved remote-support sessions, primarily using Quick Assist.T1557 · Adversary-in-the-MiddleIn the ESC8 case, the attacker relayed domain-controller NTLM authentication to AD CS Web Enrollment; the article states that name-resolution poisoning was not established.T1566.003 · Spearphishing via ServiceAttackers used Microsoft Teams messages to impersonate support personnel and persuade users to grant remote access.T1566.004 · Spearphishing VoiceTeams calls formed part of the support-impersonation and social-engineering activity.T1649 · Steal or Forge Authentication CertificatesAttackers obtained certificates through AD CS abuse and used them for certificate-based authentication.

Vendors

MicrosoftMicrosoft Threat Intelligence investigated two human-operated intrusions in which threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineer users into granting

Products

BunOnce connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authenticationJavaOnce connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authenticationMicrosoft Defender for EndpointExecution Bun, or Java runs staged scripts from user-writable paths. Microsoft Defender for EndpointMicrosoft Defender for IdentityDiscovery Staged runtimes query host configuration and interact with domain infrastructure. Microsoft Defender for IdentityMicrosoft Defender XDRMicrosoft Defender XDR detections and disruptionMicrosoft Quick Assistdesk personnel and socially engineer users into granting interactive remote access, primarily through Quick Assist.Microsoft TeamsMicrosoft Threat Intelligence investigated two human-operated intrusions in which threat actors used Microsoft Teams messages and calls to impersonate IT or help desk personnel and socially engineer users into grantingPythonOnce connected, the threat actors staged portable Python, Bun, or Java runtimes, performed host and network discovery, and assessed Active Directory Certificate Services (AD CS) for certificate-based authentication

Tools

RCloneThe attacker continued to use it for network and remote-interactive logons, reached a file server, and launched a renamed copy of Rclone using the filename SearchApp.exe.

Related Articles