Help desk impersonation leads to AD CS abuse via ESC1 and ESC8

1. Executive summary

Microsoft Threat Intelligence has documented two human-operated intrusions in which attackers impersonated IT help desk staff over Microsoft Teams, talked users into opening Quick Assist sessions, and used that hands-on-keyboard access to stage portable runtimes and attack Active Directory Certificate Services. In the first case the attacker abused an ESC1-vulnerable certificate template to obtain authentication certificates for eleven privileged accounts across two phishing waves, performed DCSync, and exfiltrated file-server data with a renamed Rclone after one privileged identity was excluded from automated containment. In the second case the attacker used PetitPotam to coerce domain-controller authentication and relayed it to AD CS Web Enrollment (ESC8), obtaining a domain-controller certificate and a Kerberos TGT via PKINIT before the customer isolated the workstation. No CVE is associated with this activity and Microsoft does not attribute it to a specific threat actor. For EMEA financial services the exposure is configuration-driven: any estate with permissive authentication-capable certificate templates or NTLM-exposed Web Enrollment endpoints can convert a single user-approved remote session into domain-level access that survives password resets and reimaging.

2. Regulatory framing

3. Technical analysis & attack chain

Microsoft investigated two separate intrusions. Both began with the same social-engineering and remote-access sequence and diverged at the certificate layer. Neither exploited a vulnerability in Microsoft Teams. The activity is not attributed to a named threat actor, and no MITRE ATT&CK profile for an actor is available for this item, so attribution is unconfirmed.

Confirmed attack chain, shared by both cases:

1. The attacker sent Teams messages and placed calls impersonating IT or help desk personnel. Organization-themed onmicrosoft.com tenant names and support-oriented display names were used to make the external contact look familiar.
2. The user was guided to open Quick Assist and provide the connection code, giving the attacker an interactive remote session with hands-on-keyboard control. Other remote-support tools were used in some deployments.
3. Inside the session the attacker placed an archive in the victim's Downloads folder, created a KB-prefixed staging directory under the user's profile, extracted the archive there, and launched the included payload with a portable Python, JavaScript or Java runtime.
4. The payload queried Windows version information, network configuration and running processes, then connected to domain infrastructure over LDAPS and SMB and began assessing AD CS for certificate-based authentication paths.

The runtime and packaging varied. In one JavaScript variant a renamed executable retained version metadata identifying it as the Bun runtime and launched the staged loader. A separate variant used a staged Java runtime to launch a Java source file. Microsoft's position is that file names alone are weak indicators; the actionable pattern is a portable runtime launched from a newly created, user-writable staging directory after an unauthorized remote session, followed by script execution, discovery commands, or connections to identity infrastructure.

Case 1, ESC1 template abuse. The first Teams phishing wave targeted three user accounts and compromised one workstation. From that foothold the attacker found a certificate template vulnerable to ESC1, meaning a requester can supply identity information in the certificate request and obtain a certificate that supports authentication, and broad enrollment rights and weak issuance controls are present. The attacker obtained certificates for three highly privileged accounts. Microsoft Defender attack disruption restricted remote logons and SMB access for the compromised user and those three identities and disconnected active sessions, but one privileged account was excluded from automated response and remained usable. About 90 minutes after the first disrupted session the attacker launched a second wave against 16 users, compromised another workstation, and obtained certificates for eight more privileged accounts. Attack disruption blocked more than 1,000 subsequent SMB file-access attempts and additional logon attempts. Within seconds of obtaining one privileged certificate the attacker authenticated to a domain controller and performed DCSync while containment was taking effect. The excluded privileged account was then used for network and remote-interactive logons to reach a file server, where the attacker ran a renamed copy of Rclone under the filename SearchApp.exe. The command recursively copied data from a file-server share to an external SFTP destination, used 20 concurrent transfers, selected files up to three years old, and excluded several executable, database, virtual-disk, media, temporary and log file types.

Case 2, ESC8 NTLM relay. The ESC1 path was not available in this environment. The attacker used PetitPotam to send requests over the Encrypting File System Remote Protocol (EFSRPC), causing the domain controller to authenticate to an attacker-controlled system using its machine account. The attacker relayed that NTLM authentication to AD CS Web Enrollment without knowing the domain controller's password. The enrollment endpoint accepted NTLM without sufficient relay protection, so the AD CS server authenticated the domain-controller machine account even though the connection originated from another device. The attacker requested and retrieved a certificate using the Domain Controller template through the certificate submission and retrieval endpoints under /certsrv, then used the certificate for Kerberos PKINIT and obtained a TGT for the domain controller. Microsoft Defender generated ESC8-related alerts, the customer isolated the workstation associated with the certificate-enrollment and Kerberos activity, and no further progression was observed.

Why the certificate layer matters. An authentication certificate for a privileged user or machine account is usable independently of the compromised password. Resetting the user's password or reimaging the first workstation does not revoke an issued certificate or invalidate Kerberos tickets already issued. Certificate revocation and Kerberos ticket review are separate containment actions from device isolation.

Investigation pivots Microsoft names: for ESC8, the identity-to-source mismatch between the domain-controller machine account and the originating device, correlated across the machine account, source device, Web Enrollment request, CA issuance record and subsequent Kerberos activity. Isolated access to /certsrv is not malicious by itself and must be correlated with the authenticated identity, source device, process and CA request. PKINIT success is the response threshold: investigate the requesting device, authenticated account, issued certificate, active Kerberos sessions and any service-ticket use.

Confidence caveat: this account rests on a single Microsoft Threat Intelligence report. The three file hashes in section 5 are single-sourced and should be verified before enforcement. The case details (account counts, timing, Rclone parameters) are as Microsoft describes them and have not been independently corroborated.

4. Mitigation & containment

P1 within 24 hours

• Audit AD CS for ESC1-vulnerable templates. For every template with the "Supply in the request" / enrollee-supplies-subject setting enabled, confirm whether it also carries an authentication EKU and broad enrollment rights. Remove the enrollee-supplied subject setting or restrict enrollment to the minimum group. Microsoft's ESC1 detection guidance is the reference for the template properties to check.
• Audit AD CS Web Enrollment for ESC8 exposure. Where the /certsrv endpoint accepts NTLM, enable Extended Protection for Authentication and require HTTPS on the CA and Web Enrollment roles, or disable Web Enrollment where it is not needed. These are the relay protections Microsoft identifies as missing in Case 2.
• Revoke certificates issued to any identity implicated in a suspected incident and review Kerberos tickets already issued. Password reset and reimaging do not revoke a certificate.
• Review automated-containment exclusions. Case 1 shows a single privileged account excluded from attack disruption remaining usable for file-server access and exfiltration. Confirm no privileged identity is excluded from automated response without a documented, reviewed justification.
• Hunt for Quick Assist sessions initiated after an inbound external Teams contact. Correlate Teams chat and call records with endpoint remote-session telemetry.

P2 within 72 hours

• Hunt for portable runtimes launched from KB-prefixed staging directories. Microsoft's hunting query matches bun.exe, java.exe or javaw.exe running .js or .java files from a path matching \AppData\Roaming\KB[0-9]+\, and network connections from those processes to ports 80, 445, 636 and 88. Run both queries across the last 7 days and extend the window if Teams contact is suspected earlier.
• Hunt for Rclone masquerading as SearchApp.exe, and for outbound SFTP transfers from file servers with high concurrency. The Case 1 command used 20 concurrent transfers and a three-year file-age window; those parameters are distinctive enough to search for in process command lines.
• Block or alert on EFSRPC coercion attempts from non-DC hosts. PetitPotam relies on a host causing a domain controller to authenticate outward; monitor for domain-controller machine-account authentication originating from a device other than the DC.
• Enable the Microsoft Defender alerts Microsoft lists for this chain where the corresponding workloads are licensed: the Teams external-contact and impersonation alerts in Defender for Cloud Apps / Office 365, the AD CS enumeration and certificate-request alerts in Defender for Identity, the NTLM relay and AD CS machine certificate issuance (ESC8) alerts in Defender for Endpoint, and the PKINIT and Kerberos ticket-request alerts in Defender for Identity.

P3 within 7 days

• Add the section 6 Sigma rule to detect renamed Bun or Java runtimes executing scripts from user-writable KB-prefixed directories.
• Restrict inbound external Teams communication to named, verified partner tenants where business need allows, and surface external-sender warnings to users.
• Brief service desk and staff on the pattern: an inbound Teams call claiming to be IT, followed by a request to open Quick Assist and share a connection code. Legitimate IT support does not obtain access this way without a ticket reference the user can verify independently.
• Rehearse certificate revocation and Kerberos ticket review as part of the incident playbook so they run alongside, not after, device isolation.

5. Indicators of compromise

Microsoft labels these as initial-access JavaScript and Python scripts. The hashes are single-sourced; verify before enforcing blocklists.

sha256  85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17
sha256  f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001
sha256  06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7

Behavioural indicators

6. Detection

rule AT_ADCS_Staged_Runtime_Loader
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-30"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/"
        description = "Detects staged loader scripts referencing KB-prefixed staging paths and portable runtime execution consistent with the Microsoft-documented ESC1/ESC8 intrusion chain. Strings are drawn from Microsoft's hunting queries and case description."
    strings:
        $kb_path = "\\AppData\\Roaming\\KB" ascii nocase
        $bun = "bun.exe" ascii nocase
        $java = "java.exe" ascii nocase
        $javaw = "javaw.exe" ascii nocase
        $certsrv = "/certsrv" ascii nocase
        $efsrpc = "EFSRPC" ascii nocase
        $searchapp = "SearchApp.exe" ascii nocase
        $rclone = "rclone" ascii nocase
    condition:
        uint16(0) == 0x5A4D and
        (
            ($kb_path and 1 of ($bun, $java, $javaw)) or
            ($certsrv and $efsrpc) or
            ($searchapp and $rclone)
        )
}

Note: the $certsrv/$efsrpc and $searchapp/$rclone pairs are behavioural strings that may appear in legitimate tooling; treat matches as investigation leads, not proof of compromise. The KB-prefixed path combined with a portable runtime name is the strongest single signal.

title: Portable runtime executing scripts from KB-prefixed staging directory
id: 7c2e4a91-3b6d-4f18-9a52-1d8e6f0c4b73
status: experimental
description: Detects Bun, Java or Python runtimes launching scripts from a newly created KB-prefixed directory under the user profile, consistent with the Microsoft-documented ESC1/ESC8 intrusion chain.
references:

    - https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/
author: Adverse Trace
date: 2026-10-30
logsource:
    category: process_creation
    product: windows
detection:
    selection_runtime:

        - Image|endswith:
            - '\bun.exe'
            - '\java.exe'
            - '\javaw.exe'
            - '\python.exe'
        - OriginalFileName:
            - 'bun.exe'
            - 'java.exe'
            - 'javaw.exe'
    selection_script:
        CommandLine|contains:

            - '.js'
            - '.java'
            - '.py'
    selection_path:
        CommandLine|contains: '\AppData\Roaming\KB'
    condition: selection_runtime and selection_script and selection_path
falsepositives:

    - Legitimate developer tooling run from a user profile directory named KB followed by digits
level: high

7. Sources

• Microsoft Threat Intelligence, "From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths", Microsoft Security Blog, 2026-10-30. https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/

8. Adverse Trace position

Adverse Trace assesses this as a configuration-exposure intrusion path rather than a product vulnerability: no CVE is assigned, no actor is attributed, and the impact depends entirely on whether the target estate has ESC1-vulnerable templates or NTLM-exposed Web Enrollment. Where those conditions exist, a single user approving a Quick Assist session can lead to domain-controller certificates, DCSync and data exfiltration within hours, and the certificate layer survives the password resets and reimaging that most response playbooks reach for first. The Case 1 outcome, where one excluded privileged identity remained usable and carried the exfiltration, is the detail clients should test against their own automated-containment exclusions. We will track Microsoft's follow-up reporting and any actor attribution, and we recommend clients run the AD CS template and Web Enrollment audit in section 4 as the first action, because it is the one control that closes both branches of this chain.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.