Microsoft Details Teams Intrusions Abusing AD CS Certificate Weaknesses
Summary
Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and abusing insecure AD CS configurations. In one, company data was copied to an external server; the amount was not disclosed.
Key points
- In both intrusions, attackers posed as company IT or help desk staff on Teams and persuaded employees to give them control through Windows Quick Assist.
- In one intrusion, attackers abused an ESC1 certificate template to obtain certificates for privileged accounts, then used DCSync; Microsoft did not say how much credential data was obtained.
- An account excluded from automatic containment remained usable, allowing the attacker to access a file server and use Rclone to copy company data to an external SFTP server. The amount copied was not disclosed.
- In the second intrusion, attackers used PetitPotam to coerce domain-controller authentication, relayed it to AD CS web enrollment through ESC8, and obtained a certificate for the domain controller.
- Microsoft said isolating the workstation in the second intrusion stopped further activity; in the first, Defender blocked many attempts but did not contain every privileged identity.
- Microsoft says certificates issued through misconfigured templates can remain usable after a password reset or machine wipe. EPA is enabled by default for AD CS in Windows Server 2025, while Server 2022 and 2019 require manual enablement.
- Microsoft provided Defender alerts and four advanced hunting queries as investigation starting points, not proof on their own.
Article Details
- Attack Vectors
- Attackers impersonated company IT or help-desk staff in Microsoft Teams messages and calls, persuading employees to open Quick Assist and share its connection code.
- After gaining workstation control, attackers dropped and unpacked an archive, then ran its contents using a portable Python, Bun, or Java runtime.
- In one intrusion, attackers abused an ESC1 AD CS certificate template to request certificates representing privileged accounts, then used a certificate to access a domain controller and run DCSync.
- In the other intrusion, attackers used PetitPotam to coerce a domain controller into authenticating to an attacker-controlled machine, relayed the NTLM authentication to AD CS web enrollment (ESC8), and requested a certificate for the domain controller.
- An attacker used a privileged account excluded from automatic containment to access a file server and copy data from a share to an external SFTP server using a renamed copy of Rclone.
- Defensive Notes
- Review AD CS certificate-template configuration and address ESC1 exposure; secure AD CS web enrollment against ESC8 relay abuse.
- Enable Extended Protection for Authentication (EPA) for AD CS. Microsoft said it is enabled by default for AD CS in Windows Server 2025, while Windows Server 2022 and 2019 require manual enablement.
- Ensure identity containment covers every affected privileged account. Microsoft reported that an excluded account remained usable after other identities were disrupted.
- Isolate affected workstations when warranted; Microsoft said workstation isolation stopped further activity in the second intrusion.
- Treat password resets and wiping the first machine as insufficient to invalidate an already-issued certificate, according to Microsoft.
- Microsoft described its advanced hunting queries as starting points for investigation, not proof on their own.
MITRE ATT&CK
T1003.006 · DCSyncAn attacker ran DCSync on a domain controller to copy password data from Active Directory; Microsoft did not state how much credential data was obtained.T1048 · Exfiltration Over Alternative ProtocolAn attacker used Rclone to move data from a file share to an external SFTP server.T1078.002 · Domain AccountsCertificates obtained through AD CS were used to sign in as privileged domain accounts.T1105 · Ingress Tool TransferAfter gaining workstation access, attackers dropped an archive into the Downloads folder and unpacked it.T1187 · Forced AuthenticationIn the second intrusion, PetitPotam was used to force a domain controller to authenticate to an attacker-controlled machine.T1219 · Remote Access ToolsAttackers persuaded employees to open Quick Assist and provide the connection code, enabling remote control of their workstations.T1557 · Adversary-in-the-MiddleThe coerced NTLM authentication was relayed to the AD CS web enrollment page in the ESC8 attack.T1649 · Steal or Forge Authentication CertificatesAttackers abused misconfigured AD CS templates to obtain certificates representing privileged accounts, including a domain controller.T1656 · ImpersonationAttackers posed as company IT or help-desk staff in Teams messages and calls to gain employees' trust.
Vendors
Products
Active Directory Certificate Services (AD CS)employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for aMicrosoft Defender Antimalware Platformthree users and one workstation, producing certificates for three highly privileged accounts. Microsoft Defender's automatic attack disruption cut those identities off and dropped their active sessions. OneMicrosoft Quick AssistThey talked each user into opening Quick Assist, a remote-help tool built into Windows, and reading the connection code back to them. That gave the attacker direct, hands-on control of the workstation.Microsoft TeamsAttackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain loginWindows Server 2025Newer Windows is less exposed to the ESC8 step. Microsoft turned EPA on by default for AD CS in Windows Server 2025, whereas Server 2022 and 2019 require it to be enabled manually.
Tools
DCSyncWithin seconds of obtaining a certificate, the attacker signed in to a domain controller and ran DCSync, a tool for copying password data from Active Directory. The operation had already begun when containment tookRCloneThe attacker kept using it, reached a file server, and ran a renamed copy of the file-copying tool Rclone to move data from a share to an outside SFTP server. Microsoft did not say how much data was taken.