From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.

This article has been indexed from Microsoft Security Blog