As cited
Copy frozen at (site build).
threat intel
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Microsoft Threat Intelligence documented two intrusions where attackers used Teams to impersonate IT support, gained remote access to workstations, then exploited Active Directory Certificate Services misconfigurations to obtain certificates for privileged accounts. In the first case, attackers abused an ESC1-vulnerable template to get certificates for high-privilege identities and performed directory replication; in the second, they used PetitPotam to coerce domain-controller authentication and relayed it to an enrollment endpoint (ESC8) to obtain a domain-controller certificate. Partial containment in the first incident left one privileged account available for data theft, while full device isolation in the second prevented further progression.
Why it matters: Enterprise environments relying on Active Directory Certificate Services face credential compromise and lateral movement if certificate templates allow low-privilege requesters to obtain certificates for privileged accounts or if enrollment endpoints lack relay protection; defenders must inventory AD CS configurations, enforce channel-binding on web enrollment, exclude no identities from automated response, and correlate certificate issuance with Kerberos activity to detect these attacks.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Microsoft Threat Intelligence documented two intrusions where attackers used Teams to impersonate IT support, gained remote access to workstations, then exploited Active Directory Certificate Services misconfigurations to obtain certificates for privileged accounts. In the first case, attackers abused an ESC1-vulnerable template to get certificates for high-privilege identities and performed directory replication; in the second, they used PetitPotam to coerce domain-controller authentication and relayed it to an enrollment endpoint (ESC8) to obtain a domain-controller certificate. Partial containment in the first incident left one privileged account available for data theft, while full device isolation in the second prevented further progression.
Why it matters: Enterprise environments relying on Active Directory Certificate Services face credential compromise and lateral movement if certificate templates allow low-privilege requesters to obtain certificates for privileged accounts or if enrollment endpoints lack relay protection; defenders must inventory AD CS configurations, enforce channel-binding on web enrollment, exclude no identities from automated response, and correlate certificate issuance with Kerberos activity to detect these attacks.
- Source published
- First seen by Cybersecurity Tracker