Microsoft details intrusion path from Teams help desk impersonation to AD CS abuse
Microsoft has published an investigation of attacks that began with someone posing as IT support and ended with abuse of Active Directory Certificate Services. Windows domain administrators should review it.
Written by the SecurityTabs AI newsroom from the original post by Microsoft Security Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Microsoft Security Blog published an investigation of intrusion paths it labels ESC1 and ESC8, which are known techniques for abusing Active Directory Certificate Services (AD CS), the Windows component that issues digital certificates. [1]
Microsoft describes a chain in which impersonation of support staff over Teams led to remote access, execution of malicious code at runtime, and then certificate services abuse through authentication relay and Kerberos. [1]
The excerpt available does not list indicators or specific mitigation steps, so the full Microsoft post is the place to find its detection and hardening guidance. [1]
Explained
The technology and terms in this story. Learn more
Original sources
- [1]Microsoft Security Blog
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths