Teams Help Desk Impersonation Leads to AD CS Attacks

• •Attackers impersonated help desk staff via Microsoft Teams to gain remote access.
• •Two distinct methods exploited AD CS vulnerabilities: ESC1 and ESC8.
• •Microsoft Defender mitigated some attacks, but data exfiltration still occurred.

Microsoft reported two human-operated intrusions involving help desk impersonation via Microsoft Teams. Attackers socially engineered users into granting remote access through Quick Assist. In the first case, an attacker abused an ESC1 template to obtain authentication certificates for privileged accounts, leading to data theft. In the second case, an attacker used PetitPotam to relay NTLM authentication to AD CS Web Enrollment (ESC8), but further activity was halted after isolating the affected workstation. The incidents highlight vulnerabilities in Active Directory Certificate Services (AD CS) configurations. Microsoft Defender mitigated some follow-on activity, but a privileged identity was still exploited for data exfiltration. The incidents did not exploit vulnerabilities in Microsoft Teams but relied on social engineering tactics. Recommendations for mitigation and detection guidance were provided by Microsoft.