Microsoft traces help desk impersonation to AD CS certificate abuse

Microsoft Threat Intelligence observed two human-operated intrusion cases on Oct. 30, 2026, in which attackers impersonated IT and help desk personnel through Microsoft Teams messages and calls to socially engineer users into granting remote access through Quick Assist.

Microsoft Threat Intelligence said the activity did not exploit a Microsoft Teams vulnerability. Attackers depended on social engineering and lax or excessively broad Active Directory Certificate Services configurations, specifically ESC1 and ESC8. They used tenant names with organization themes on onmicrosoft.com and display names with support themes to make external Teams contacts seem familiar. Once users granted access, attackers placed an archive in the victim’s Downloads folder, extracted it into a newly created directory under the user’s profile, and executed attacker-controlled scripts using portable runtimes such as Python, Bun, or Java.s

After gaining remote access, attackers performed host and network discovery. They queried Windows version information, network configuration, and running processes to assess Active Directory Certificate Services for certificate-based authentication paths. The compromised workstation connected to domain infrastructure over LDAPS and SMB. Discovery commands became high-value signals when launched by renamed runtimes from uncommon locations after unauthorized remote sessions.s

Case 1 began with a Teams-phishing wave targeting three user accounts that compromised one workstation. Microsoft Defender attack disruption acted against the first compromised user and three certificate-compromised identities, limiting remote logons and SMB access and ending active sessions. Roughly 90 minutes after the first disrupted session, the attacker started a larger Teams-phishing wave against 16 users and compromised another workstation.s

In the first wave, the attacker abused an ESC1-vulnerable certificate template in Enterprise CA Security Configuration 1 to obtain authentication certificates for three highly privileged accounts. ESC1 allows low-privileged users to abuse misconfigured certificate templates by supplying identity information, such as Subject Alternative Name, to obtain authentication certificates for privileged accounts. Templates vulnerable to ESC1 require no manager approval and allow broad enrollment rights for low-privileged users. Microsoft said the abuse enabled DCSync attacks.s

In the second wave, the attacker obtained certificates for eight additional privileged accounts using the same ESC1-vulnerable template. This expanded the certificate-based privilege in Case 1. Microsoft Defender blocked over one thousand later SMB file-access attempts and more logon attempts, limiting the attacker’s ability to reuse the compromised accounts for lateral movement.s

The attacker performed DCSync against a domain controller within seconds of obtaining one privileged certificate while containment was taking effect. Attack disruption limited additional replication, but the DCSync operation had already begun. The attacker used an excluded privileged account for network and remote-interactive logons, reached a file server, and executed a renamed Rclone copy called SearchApp.exe.s

The Rclone command transferred data to an external SFTP destination with 20 concurrent transfers and selected files up to three years old. The command excluded executables, databases, virtual disks, media, temporary, and log file types. Microsoft Defender disrupted the attack in Case 1 by restricting covered identities and blocking follow-on activity, but the excluded privileged account remained usable and later supported data exfiltration.s

In Case 2, attackers used PetitPotam to coerce a domain controller into authenticating to an attacker-controlled system. PetitPotam used the Encrypting File System Remote Protocol to make the domain controller authenticate with its machine account. The attackers then relayed the NTLM authentication to AD CS Web Enrollment under ESC8 to obtain a certificate for the domain-controller account. AD CS authenticated the domain-controller machine account although the connection came from another device, an identity-to-source mismatch investigators can use as a pivot.s

Authenticating to Web Enrollment as the domain controller, the attacker asked for and downloaded a certificate based on the Domain Controller template through endpoints under /certsrv. The certificate enabled Kerberos PKINIT authentication, granting persistent domain-controller-level access. PKINIT success is the response threshold for investigators, who should examine the requesting device, authenticated account, issued certificate, active Kerberos sessions, and service-ticket use.s

Microsoft Defender generated ESC8-related alerts in Case 2, prompting the customer to isolate the associated workstation. That isolation halted further attack progression, and Microsoft observed no further progression after the customer-led device isolation.s

ESC1 requires four conditions: enrollment rights for low-privilege users, no manager approval, the ENROLLEE_SUPPLIES_SUBJECT flag set, and Client Authentication EKU 1.3.6.1.5.5.7.3.2. All four conditions must be true for a template to be vulnerable to ESC1. Defenders can detect ESC1 by monitoring Certificate Services audit logs, Event IDs 4886 and 4887, for requests where the issued certificate’s Subject Alternative Name does not match the requester’s identity. Certificate Services audit event IDs also include 4888 for denial, 4889 for pending status, and 4890 for revocation configuration changes.s

ESC8 involves relaying NTLM authentication from a domain controller, coerced via PetitPotam, to AD CS Web Enrollment, allowing attackers to request and obtain a certificate for the domain-controller account. ESC8 requires NTLM relay to AD CS Web Enrollment or Certificate Enrollment Web Service, which accepts NTLM without HTTPS plus Extended Protection for Authentication. Investigators should correlate EFSRPC activity, outbound domain-controller authentication, the relaying device, Web Enrollment access, CA request and issuance records, and originating-workstation PKINIT.s

A newly disclosed vulnerability, CVE-2026-54121, also known as Certighost, allows any authenticated domain user to obtain a certificate impersonating a domain controller without administrative rights. Microsoft patched the vulnerability on July 14, 2026, but public proof-of-concept exploits now exist. The vulnerability affects Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. Certighost was disclosed in research published July 28, 2026.s

Certighost exploits a gap in AD CS’s enrollment fallback mechanism, known as the chase, where the ms-DS-MachineAccountQuota attribute, set by default to 10, allows attackers to register computer accounts and manipulate identity-resolution queries to impersonate domain controllers. The attack chain begins with registering a computer account and submitting a certificate request with manipulated cdc and rmd attributes. Unlike ESC1 and ESC8, Certighost does not depend on misconfigured certificate templates but exploits default AD CS behavior.s

Certighost enables DCSync attacks to extract the krbtgt secret and compromise the entire Active Directory forest. Organizations previously hardened against ESC-series misconfigurations remain vulnerable because Certighost relies on default behavior rather than template mistakes. Cloud Security Alliance said, “Certighost demonstrates that the underlying trust model still contains gaps beyond template permissions.”s

Microsoft Defender for Identity provides security posture assessments for Active Directory Certificate Services, including detecting ESC1, ESC8, and ESC6, which covers CA policy misconfigurations. The assessments recommend enforcing HTTPS plus Extended Protection for Authentication on enrollment endpoints and restricting template permissions. Defender for Identity also provides actionable remediation steps for these findings.s

Microsoft Defender XDR connects collaboration, endpoint, identity, certificate, and Kerberos signals to detect and disrupt ESC1 and ESC8 attacks, including Teams impersonation, portable runtime execution, and certificate abuse. Advanced hunting queries and Security Copilot can help analysts investigate attack chains and prepare containment tasks. Customers can use Defender XDR Threat Analytics to investigate related incidents and search for AD CS certificate abuse and ESC1 or ESC8 activity.s

Microsoft said a password reset for a compromised user or reimaging the first workstation neither revokes an issued certificate nor invalidates Kerberos tickets already issued. AD CS creates a durable authentication path independent of the initially compromised password. Revoking a certificate and reviewing Kerberos tickets are separate containment actions, and revoking a certificate cannot retroactively cancel TGTs or service tickets already issued.s

Endpoint and directory logs are required to determine what the initiating process did, because TLS actively conceals LDAP query content from passive network observation. Network data can identify LDAPS and SMB connections, but logs are required for process attribution. Investigators should correlate the machine account, source device, Web Enrollment request, CA issuance record, and Kerberos activity.s

File names alone are weak indicators of malicious activity. The useful pattern is a portable runtime started from a freshly made user-writable staging folder following an unauthorized remote session. Runtime choice can change between deployments, so defenders should validate AD CS behavior through initiating process, account, device, and certificate records rather than assuming from Bun or Java presence alone. One JavaScript variant used a renamed executable with version metadata showing it was the Bun runtime before launching a staged loader, while another variant launched a Java source file using a staged Java runtime.s

Defenders should require staff to confirm unexpected support invitations through a recognized internal path before answering a call, showing their screen, or beginning remote control. Microsoft Teams external-access and federation policies need review. Outside domains should remain limited to business requirements, and defenders should investigate new tenants that use organization or helpdesk themes in context. Defenders should generate alerts when approved remote monitoring and management tools unpack archives, build interpreters, or run scripts from user-writable paths.s

Defenders should use App Control for Business or an equivalent tool to block unauthorized portable runtimes and script execution launched from folders users can write to. Defenders should verify attack surface reduction rules and check endpoint protection policies. They should not assume Windows script host controls automatically cover JavaScript running through Bun or Java source files. Defenders should assess file identity by checking behavior, parent process, path, product metadata, original filename, and signer, since a renamed executable can keep legitimate version information.s

Defenders should inventory AD CS Web Enrollment and Certificate Enrollment Web Service endpoints and remove endpoints that are not required. Defenders should require HTTPS and enforce Extended Protection for Authentication on enrollment web endpoints, and disable NTLM on enrollment services where operationally feasible. HTTPS protects confidentiality, while EPA provides channel binding to resist NTLM relay.s

Defenders should enable success and failure auditing in the Certification Services advanced audit subcategory and set the Certification Authority audit filter to log request and issuance activity. If an unauthorized certificate was issued, defenders should identify its serial number and thumbprint, revoke it, publish updated revocation information, and confirm relying systems can obtain the update. AD CS hardening should focus on least-privilege template permissions, disabling unnecessary enrollment rights, and enabling Certificate Services auditing to detect anomalous certificate issuance.s

Defenders should treat containment exclusions as incident decisions. When an account or device resists automatic containment, defenders should assign a compensating manual action and confirm completion. Security Copilot helps analysts summarize the path from Teams to remote access, examine staged runtime behavior, match certificate alerts to affected identities, and build containment tasks. Results depend on connected plugins, permissions, and evidence available to the incident.s

Microsoft’s investigation is not attributed to a specific threat actor. Microsoft Threat Intelligence said, “A user-approved remote session can become certificate-backed access to privileged identities and domain infrastructure.”s