ESC1 and ESC8 Attacks Expose Active Directory Security Risks

Through Microsoft Teams, cybercriminals are impersonating IT support personnel in order to gain access to corporate systems and exploit vulnerabilities in Active Directory Certificate Services (AD CS). 

As the outcome of the social engineering and misconfigured certificate services, attackers obtained authentication certificates for privileged accounts, including domain controllers, through two human-operated intrusions identified by Microsoft Threat Intelligence.
In accordance with Microsoft's investigation published on October 30, 2026, both incidents were initiated by attackers posing as internal IT or help desk staff through Teams messages and phone calls. 
By using names related to support and familiar-looking display names associated with external Microsoft tenants, attackers convinced employees to open Quick Assist, a remote assistance application on Windows, and provide the connection code to the attacker.
It was through this process that the attackers were able to gain direct control over the targeted workstations. 
After gaining initial access, attackers transferred archive files into the Downloads folder and extracted the contents of the archive files into newly created directories resembling Windows update folders. The extracted files were executed using Python, Bun, or Java runtimes.
By using these tools, malicious scripts could be executed from user-accessible locations, while renamed executables retained the metadata associated with legitimate software files. 
In order to conduct reconnaissance on the system and network, the attackers examined Windows versions, network configurations, running processes, and connections to internal domain infrastructures.
The team also assessed AD CS configurations to identify potential privilege escalation opportunities. AD CS is a Windows service that is responsible for issuing digital certificates necessary for identifying users and computer accounts.
When certificate templates are not configured securely, attackers can obtain certificates representing privileged identities, which can then be used to authenticate without relying on the original password for authentication.

After a password reset or reimage of the initial compromised workstation, these certificates may remain useful unlike conventional credentials. 
According to Microsoft, two certificates have been misused in the investigated incidents: ESC1 and ESC8. The first involved exploiting a misconfigured certificate template, which enabled attackers to obtain certificates for privileged accounts.
NTLM relay attacks were carried out against AD CS Web Enrollment using PetitPotam to force a domain controller to authenticate to an attacker-controlled system. 
As demonstrated by these two incidents, even a seemingly routine interaction with IT support can be an entryway into identity-based attacks of greater scope. Neither intrusion exploited a Microsoft Teams vulnerability.
By exploiting weaknesses in the certificate infrastructure and employee deception, the attackers were able to move beyond the compromised workstations originally compromised. 
ESC1 Abuse Leaves a Privileged Account Exposed
First, the attackers obtained authentication certificates for privileged accounts by exploiting a certificate template that was vulnerable to ESC1 attacks. As a result of Microsoft Defender's automated attack disruption, three highly privileged identities were affected in the initial wave, resulting in certificates for three highly privileged identities. Active sessions were disconnected, remote logons were blocked, SMB access was blocked, and accounts were restricted. 
A privileged account was, however, excluded from the automated response and continued to be accessible about 90 minutes later. An additional phishing wave targeted 16 users and a second workstation. In addition to blocking more than 1,000 attempts to access SMB files and logons, Defender also blocked certificates for eight more additional privileged accounts obtained by the attackers.
Using one privileged certificate, the attackers have already authenticated with a domain controller and initiated a DCSync operation that replicates password data from Active Directory. In spite of Microsoft's claim that containment limited further activity, it was not disclosed to the public how much credential information was obtained. 
An account excluded from automated containment provided another route to access the network.
Attackers accessed a file server and executed a version of Rclone disguised as SearchApp.exe, which copied files from a network share to an external SFTP server. However, Microsoft did not disclose the volume of data that was stolen. 
PetitPotam and ESC8 Target Domain Controller Identity
Because the environment did not contain the ESC1 weakness, the second intrusion followed a different certificate-abuse path. Rather, the attackers used PetitPotam to initiate authentication between a domain controller and the system they were controlling from a domain

Read the original article:

ESC1 and ESC8 Attacks Expose Active Directory Security Risks