"partial identity containment can reduce attack activity while still leaving a viable privileged route," Microsoft warned after investigating two intrusions that mixed social engineering on Microsoft Teams with misconfigured Active Directory Certificate Services (AD CS).
Teams and Quick Assist: the initial social engineering
Both intrusions began the same way: attackers posed as internal IT or help-desk staff on Microsoft Teams, using outside tenants with support-themed names so the contact looked familiar. They called and messaged employees and convinced them to open Quick Assist, the remote-help tool built into Windows. By reading back a Quick Assist connection code, the targeted user handed the attacker hands-on control of the workstation.
From the compromised desktop the attackers dropped an archive into Downloads, unpacked it into a folder named to resemble a Windows update, and executed its contents using a portable runtime — examples Microsoft cited include Python, Bun, or Java. Microsoft noted file names were a weak detection signal: one copy was renamed while still carrying the real runtime's version details.
AD CS certificate weaknesses: ESC1, ESC8, and PetitPotam
AD CS issues the sign-in certificates that users and machines present when logging in. Microsoft flagged two established misconfiguration patterns as central to these intrusions.
- ESC1: A certificate template weakness that allows the requester to name the account the certificate will represent. That means a low-privileged user can request a certificate that impersonates a highly privileged account.
- ESC8 (via PetitPotam): Forcing a domain controller to authenticate to an attacker-controlled machine (the PetitPotam coercion), relaying that NTLM login to the AD CS web enrollment page, and requesting a certificate for the domain controller itself — which can be converted into a lasting identity via Kerberos (PKINIT).
Microsoft emphasized that a certificate obtained this way remains valid even after the account password is reset or the first machine is wiped, so neither of those actions by itself ends the attacker’s access.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTwo intrusions, two outcomes: how containment changed results
Microsoft described two separate intrusions that illustrate how containment decisions matter.
In the first case, attackers exploited an ESC1 template. An initial wave produced certificates for three highly privileged accounts; Microsoft Defender's automatic attack disruption cut those identities off and dropped active sessions, but one privileged account was explicitly excluded from the automatic response and remained usable. Ninety minutes later a larger wave produced certificates for eight more privileged accounts. Within seconds of obtaining a certificate, an attacker signed in to a domain controller and ran DCSync to copy password data from Active Directory. Containment limited replication, Microsoft said, but did not say how much credential data was obtained. The attacker then used the excluded account to reach a file server and ran a renamed copy of Rclone to move data from a share to an outside SFTP server; Microsoft did not disclose the volume of data exfiltrated.
In the second case there was no ESC1 template. The attacker used PetitPotam to coerce a domain controller to authenticate, relayed the NTLM login to AD CS web enrollment (an ESC8 abuse), obtained a certificate for the domain controller, and used Kerberos PKINIT to get a ticket-granting ticket for the domain controller. Here Defender raised ESC8 alerts, the customer isolated the workstation, and Microsoft reported no further activity. The practical difference between the two intrusions was containment: partial identity containment in the first left a viable privileged route; isolating a single workstation in the second stopped the attack.
Mitigations Microsoft recommends
Microsoft framed the intrusions as configuration and process failures rather than software flaws and offered concrete steps:
- Confirm unexpected support requests through a known internal channel before sharing a screen or granting remote control. Limit which outside Teams tenants can contact employees and permit only approved remote-support tools.
- Review sign-in certificate templates for those that let the requester name the account or allow too many users to enroll; remove enrollment rights that are not needed.
- Require HTTPS and enable Extended Protection for Authentication (EPA) on web enrollment endpoints; turn off NTLM on those endpoints where possible. Microsoft cited KB5005413 and said Defender for Identity posture checks flag templates and endpoints exposed to ESC1 and ESC8.
- Turn on certificate auditing and revoke any malicious certificate — and separately review active Kerberos tickets because revocation does not cancel tickets already issued.
- Treat any account excluded from automatic containment as a deliberate decision and assign a manual follow-up action for that account.
Indicators, detections, and what to watch for: technologists, procurement leaders, and end users
Technologists and security teams: Microsoft published Defender alerts across Teams, endpoints, and identity signals plus four advanced hunting queries described as starting points for investigation. It also provided three SHA-256 hashes tied to initial-access scripts: 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 (JavaScript), f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 (Python), and 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 (Python).
Procurement and IT leaders: limit which external tenants can reach employees, approve only vetted remote-support tools, and require proofing of unexpected support requests through an internal channel.
End users: Microsoft’s principal advice is procedural — confirm unexpected help-desk outreach before granting screen-sharing or remote control.
Microsoft did not attribute the intrusions to any named group or provide dates. It reminded readers that researchers first described ESC1, ESC8, and PetitPotam in 2021, and that Windows Server 2025 enables EPA by default for AD CS — an environmental change that makes newer deployments less exposed to ESC8. The core takeaway is blunt: no software patch would have prevented these intrusions; correct AD CS configuration and decisive, comprehensive containment did.
https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html
