Microsoft Threat Intelligence has published two intrusions that began with fake IT support on Microsoft Teams and ended with attackers holding certificates from Active Directory Certificate Services (AD CS). Microsoft says the activity did not exploit a Teams flaw. The attackers got in by persuading users, then took advantage of weak AD CS settings.
What happened
In the October 30 post, Microsoft describes human-operated activity it does not attribute to a named actor. Both cases opened on Teams: attackers messaged and called users with support-style display names and onmicrosoft.com tenant names, then talked them into approving a remote session, primarily Quick Assist. They extracted an archive to a KB-prefixed folder under the user profile, ran the payload with a portable Python, Bun or Java runtime, and then assessed AD CS.
The paths then split:
- ESC1: a certificate template let the requester supply identity information. Certificates for three highly privileged accounts came first, and a second phishing wave about 90 minutes later yielded certificates for eight more privileged accounts. DCSync followed in seconds: once one privileged certificate was in hand, the attacker signed in to a domain controller and began replicating directory data.
- ESC8: PetitPotam forced a domain controller to authenticate over EFSRPC, and AD CS Web Enrollment received that NTLM exchange by relay. The resulting Domain Controller template certificate was used for PKINIT to obtain a Kerberos TGT for the domain controller. The attacker never needed the DC's password.
In the ESC1 case, Defender attack disruption restricted the covered identities and blocked more than 1,000 later SMB file-access attempts. Automated response did not cover one privileged account, though, and the attacker used it to reach a file server and run Rclone, renamed SearchApp.exe, copying data to an external SFTP destination. In the ESC8 case, Defender alerts led the customer to isolate the workstation, and Microsoft observed no further progression.
Why it matters
A support call turned into privileged authentication because of certificate configuration. Both weaknesses are settings an AD CS owner can review, and in our view those templates and endpoints deserve the same scrutiny as Domain Admin membership.
The exclusion is the part architects should take to their next design review. Microsoft does not say why that account was excluded, only that containment did not apply to it, and the data loss came through it. An exclusion list is a set of identities an attacker can keep using, so each entry needs an owner and a manual fallback.
Revocation also has limits that belong in the runbook:
Revoking a certificate does not retroactively invalidate TGTs or service tickets that were already issued. — Microsoft Security Blog
What to check in your environment
- Audit certificate templates. Flag templates that let the requester set the subject, allow wide enrollment, have weak issuance checks or grant more certificate purposes than the use case needs. Remove enrollment rights nobody needs.
- Inventory enrollment endpoints. Find every Certificate Authority Web Enrollment and Certificate Enrollment Web Service instance and remove those you don't need. KB5005413 is the reference for the rest: accept HTTPS only and turn on Extended Protection for Authentication. Once you have confirmed Kerberos-only authentication works, turn off NTLM where you can.
- Turn on CA auditing. Have the CA log requests and issuance through its audit filter, and turn on the Certification Services advanced audit subcategory, covering both success and failure. Confirm CA security events, CA database records and IIS logs are retained.
- Review containment exclusions. List privileged accounts excluded from automated response, confirm each one is still justified, and assign a compensating manual action and an owner.
- Tighten Teams and remote support. Review external access and federation policies, allow only the remote-support tools you have approved, and tell users how to check an unexpected support contact through an internal channel they already know.
- Control and hunt portable runtimes. Block unapproved ones through App Control for Business or a comparable application control product. Microsoft's post includes Defender detections, file hashes and four advanced hunting queries, including Bun or Java running from KB-prefixed AppData\Roaming folders. Microsoft calls them starting points that need tuning.
- Update the certificate response runbook. For each unauthorized certificate, record the serial number and thumbprint before revocation, then push out fresh revocation data and verify that relying systems have it. Kerberos tickets already issued need their own assessment.