Attackers abuse AD CS and Teams social engineering to steal data

Microsoft has detailed two separate security incidents where threat actors impersonated internal IT support staff on Microsoft Teams to gain remote control of employee workstations. By exploiting misconfigured Active Directory Certificate Services (AD CS), the attackers issued fraudulent login certificates for privileged accounts, allowing them to bypass standard authentication controls and exfiltrate company data in one instance.

What happened

The intrusions began with a social engineering campaign rather than a technical exploit of software vulnerabilities. Attackers contacted employees via Microsoft Teams, using external tenants with names designed to mimic internal help desk or IT support roles. They convinced targets to use Quick Assist, a built-in Windows remote support tool, by asking them to read back connection codes. This granted the attackers direct, hands-on control over the victim's machine.

Once inside, the attackers deployed initial-access scripts disguised as Windows updates. These scripts ran using portable runtimes like Python, Bun, or Java, making detection by filename alone difficult. The primary goal was not just workstation access, but leveraging that access to interact with the organization's certificate infrastructure. AD CS issues the digital certificates that users and computers present to prove their identity during login. If this system is poorly configured, an attacker can request certificates that grant them the privileges of high-value accounts, such as domain controllers.

In the first case, the attackers exploited a template weakness known as ESC1, which allowed them to specify the account identity in the certificate request. They obtained certificates for multiple privileged accounts. While Microsoft Defender automatically disrupted most of these identities, one privileged account was excluded from the automatic response. The attackers used this remaining access to run DCSync, a tool that copies password hashes from Active Directory, and subsequently used Rclone to move data to an external SFTP server. In the second case, the attackers used a technique called PetitPotam to force a domain controller to authenticate to their machine, relaying that credential to obtain a certificate for the domain controller itself. This attempt was contained after the customer isolated the compromised workstation.

Key details

• Attackers used social engineering on Microsoft Teams to trick users into sharing remote control via Quick Assist.
• No software flaw was exploited; the attacks relied on insecure AD CS configurations and user manipulation.
• In the first incident, an excluded privileged account allowed attackers to bypass automatic containment and exfiltrate data.
• The attackers used ESC1 and ESC8 techniques to issue certificates for highly privileged accounts and domain controllers.
• Microsoft Defender blocked over 1,000 subsequent login attempts in the first case, but partial containment left a viable attack path.
• Newer Windows Server 2025 enables Extended Protection for Authentication (EPA) by default, reducing exposure to ESC8 attacks.

Background

Active Directory Certificate Services (AD CS) is a Windows server role that manages public key infrastructure (PKI) for an organization. It issues digital certificates that verify the identity of users, computers, and services. When configured securely, it is a robust authentication mechanism. However, specific misconfigurations, such as those labeled ESC1 and ESC8 by researchers, can allow attackers to abuse the system. ESC1 allows a low-privileged user to request a certificate for any other account, effectively escalating privileges. ESC8 involves relaying NTLM authentication to the AD CS web enrollment page to obtain a certificate without knowing the password.

These vulnerabilities are not new; they were disclosed in 2021. However, they require proactive configuration changes to mitigate. Unlike a software bug that can be fixed with a patch, these issues stem from how administrators set up certificate templates and enrollment policies. If an attacker obtains a valid certificate for a privileged account, that certificate remains valid even if the account password is reset or the original compromised machine is wiped, providing persistent access.

Why it matters

For teams running their own infrastructure, particularly those relying on Windows Server and Active Directory, this report highlights a critical gap between automated defense and manual configuration. Automated tools like Microsoft Defender can detect and disrupt many attack vectors, but they rely on predefined rules. If an administrator explicitly excludes an account from automatic containment policies, perhaps to avoid disrupting a critical service, that decision can create a blind spot. Attackers actively look for these exceptions, as seen in the first case where a single excluded account enabled significant data theft.

Furthermore, the reliance on social engineering underscores that technical controls alone are insufficient. Even with robust network segmentation and endpoint protection, a single employee tricked into granting remote access can bypass perimeter defenses. The use of legitimate tools like Quick Assist and portable runtimes makes these activities harder to distinguish from normal administrative work. Organizations must therefore balance technical hardening of AD CS with strict procedural controls for remote support requests.

What you can do

• Verify all unexpected support requests through a known, separate internal channel before granting remote access or sharing screens.
• Restrict which external Microsoft Teams tenants can contact your employees and limit remote support tools to approved applications only.
• Audit AD CS certificate templates to remove enrollment rights for users who do not need them and disable templates that allow requesters to specify the subject name.
• Enable Extended Protection for Authentication (EPA) on AD CS web enrollment endpoints and disable NTLM where possible to prevent ESC8 attacks.
• Implement certificate auditing and ensure that any account excluded from automatic containment has a corresponding manual monitoring process.
• Review active Kerberos tickets separately when revoking certificates, as revocation does not automatically invalidate existing tickets.