From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Microsoft Security BlogOctober 30, 2026Identity Threat Intel

Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths appeared first on Microsoft Security Blog .

Summary from Microsoft Security Blog.

Read the full article at Microsoft Security Blog

Explained

The technology and terms in this story. Learn more

ProtocolKerberosThe ticket-based login protocol Windows domains use.

From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Explained

More in Identity

Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

Passkeys Are Better Than Passwords. But They Are Not Enough.

Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw

ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories

Siemens Mendix SAML Module