Attackers Pose as IT Support on Teams and Abuse AD CS

Attackers pretended to be a company's IT help desk on Microsoft Teams, got employees to give them remote control, and then abused insecure Active Directory Certificate Services (AD CS) settings to get login certificates for privileged accounts. There is no patch, because Microsoft says no flaw in Teams was exploited. The fix is configuration and response, and you can start today.

This summary is based on The Hacker News report of Microsoft's investigation of two intrusions.

What happened in the two intrusions

Both intrusions began the same way. Attackers messaged and called employees on Teams from outside tenants with support-themed names, so the contact looked familiar.

They talked each user into opening Quick Assist, the remote-help tool built into Windows, and reading back the connection code. That gave the attacker hands-on control of the workstation.

The attacker then dropped an archive into the Downloads folder. They unpacked it into a folder named to look like a Windows update and ran its contents with a portable Python, Bun, or Java runtime.

Case 1: a template weakness and one excluded account

The attackers found a certificate template with the ESC1 weakness. The requester can name the account the certificate represents, so a low-privileged user can request a certificate for a privileged account.

The first wave hit three users and one workstation and produced certificates for three highly privileged accounts. Microsoft Defender's automatic attack disruption cut those identities off. One privileged account had been left out of the automatic response, so it stayed usable.

About 90 minutes later, a second wave hit 16 users and another workstation. It produced certificates for 8 more privileged accounts. Microsoft said more than 1,000 later attempts to reach files over SMB or to log in were blocked.

Within seconds of getting a certificate, the attacker signed in to a domain controller and ran DCSync to copy password data. Containment had already started while DCSync was running, which limited how much could be replicated. Microsoft did not say how much credential data the attacker obtained.

Using the excluded account, the attacker then reached a file server and ran a renamed copy of Rclone to move data from a share to an outside SFTP server. Microsoft did not say how much company data was taken.

Case 2: a certificate for the domain controller

The second intrusion lacked the ESC1 template weakness. The attacker used PetitPotam to force a domain controller to authenticate to a machine the attacker controlled.

That NTLM login was relayed to the AD CS web enrollment page (ESC8). The attacker requested a certificate for the domain controller and used Kerberos PKINIT to get a ticket-granting ticket. Defender raised ESC8 alerts, the customer isolated the workstation, and no further activity followed.

Who is affected

Any organization that runs AD CS with weak templates or unprotected web enrollment, and lets outside Teams users contact staff, is exposed. No product versions are listed as vulnerable. The one version-specific detail is the default for Extended Protection for Authentication (EPA) on AD CS:

How serious it is

This was seen in real intrusions, and one ended with company data copied to an external server. The risk is persistence. A certificate from a weak template keeps working after the account's password is reset or the first machine is wiped.

Microsoft's own lesson is that "partial identity containment can reduce attack activity while still leaving a viable privileged route." Microsoft did not tie the activity to a known group or give the dates of the intrusions.

The techniques are not new. Researchers named ESC1 and ESC8 in 2021, and PetitPotam was disclosed the same year. Microsoft had also documented the Teams help-desk-to-Quick-Assist entry method earlier in 2026. What is new in this report is the combination of that entry method with AD CS abuse.

What to do now

1. Tell staff to confirm any unexpected support request through a known internal channel before sharing a screen.

2. Limit which outside Teams tenants can contact employees, and allow only approved remote-support tools.

3. Review sign-in templates that let the requester name the account or that too many users can enroll in, and remove enrollment rights that are not needed.

4. Require HTTPS and turn on EPA for web enrollment endpoints. Turn off NTLM there where you can. Microsoft's KB5005413 covers this.

5. Turn on certificate auditing. Revoke bad certificates, but review active Kerberos tickets separately, because revocation does not cancel tickets already issued.

6. Treat every account excluded from automatic containment as a deliberate decision, and assign a manual response for it.

Commands and queries to check your exposure

Run these in a test window first. They are read-only checks.

Check which outside Teams domains can reach your users. This needs the Microsoft Teams PowerShell module and an active Connect-MicrosoftTeams session:

Connect-MicrosoftTeams
Get-CsTenantFederationConfiguration | Select-Object AllowFederatedUsers, AllowedDomains, BlockedDomains

List templates that let the requester supply the subject, a common sign of ESC1:

certutil -v -dstemplate | findstr /i "TemplatePropCommonName CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"

A hit is only an ESC1 risk if the template is also used for sign-in (client authentication) and broadly enrollable. Check each hit for those two things before you act. Otherwise it is not necessarily exploitable.

Check whether web enrollment is installed on a CA server, and whether EPA is set on it:

Get-WindowsFeature ADCS-Web-Enrollment
Import-Module WebAdministration
Get-WebConfigurationProperty -Location "Default Web Site/CertSrv" -Filter "system.webServer/security/authentication/windowsAuthentication/extendedProtection" -Name tokenChecking

If tokenChecking is None, EPA is not enforced. In Defender advanced hunting, look for Quick Assist use and renamed Rclone:

DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName =~ "quickassist.exe" or ProcessVersionInfoOriginalFileName =~ "rclone.exe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessVersionInfoOriginalFileName, ProcessCommandLine

Expect noise from real help desk work. Microsoft calls its own queries "starting points for investigation," not proof. Its Defender for Identity posture checks also flag templates and endpoints exposed to ESC1 and ESC8.

What IT and security learners can take from it

This case shows why identity work matters as much as patching. Learn how certificates become logins, how Kerberos tickets outlive a revoked certificate, and why containment must cover every privileged account. Our cybersecurity certification page lists exams that cover identity and incident response.

For a similar case where attackers hid their tracks after getting in, read our post on China-linked hackers using a VMware ESX zero-day to hide the audit trail. Building a small lab with AD CS and reproducing the ESC1 and ESC8 fixes teaches more than any summary.

Sources

• Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data (The Hacker News)