Executive Summary
Microsoft Threat Intelligence has identified a high-impact intrusion pattern where threat actors impersonate IT or help desk personnel via Microsoft Teams to socially engineer users into granting remote access via Quick Assist. Once interactive access is established, the attackers deploy portable runtimes (Python, Bun, or Java) to perform host discovery and assess Active Directory Certificate Services (AD CS) for misconfigurations that allow for persistent, certificate-based authentication.
The campaign utilizes two primary AD CS abuse vectors: ESC1 (abusing misconfigured certificate templates to impersonate privileged identities) and ESC8 (NTLM relay to Web Enrollment endpoints). These techniques allow attackers to bypass password resets and re-imaging by obtaining durable authentication certificates. In observed cases, failure to include all privileged accounts in automated containment protocols enabled attackers to maintain a foothold and successfully exfiltrate data.
This activity demonstrates the critical risk posed by combining social engineering with insecure identity infrastructure. Organizations are urged to harden AD CS configurations, restrict unauthorized remote management tools, and enforce strict application controls on portable runtimes in user-writable directories.