On October 30, 2026, Microsoft Threat Intelligence published its analysis of two intrusions that started the same way. Attackers used Microsoft Teams messages and calls from organization-themed external tenants to pose as IT or help desk staff, and they persuaded users to open Quick Assist and share the connection code. That gave the attackers remote control of a workstation. Microsoft has not attributed the activity to a specific threat actor, and the attackers did not exploit a vulnerability in Teams. The intrusions relied on social engineering and insecure or overly permissive Active Directory Certificate Services (AD CS) configurations.
From the workstation, the attackers ran discovery and then examined AD CS for a path to privileged accounts. In the first case, they found a certificate template vulnerable to ESC1 and used it to obtain authentication certificates for eleven privileged accounts across two phishing waves, then performed DCSync against a domain controller. In the second, they used PetitPotam to force a domain controller to authenticate to a system they controlled, relayed that NTLM authentication to AD CS Web Enrollment (ESC8), and received a certificate for the domain controller’s own machine account, which they used for Kerberos authentication. In both environments, one approved remote session became domain-level access.
Why Misconfigured AD CS Is a Privilege Escalation Path
AD CS issues the certificates that let users and machines authenticate to Active Directory without a password, and each certificate template defines who can enroll and what the certificate can do. An ESC1 template lets the requester supply the identity in the request and allows broad enrollment with no approval step. If that template also supports authentication, a low-privileged account can ask for a certificate in the name of a domain admin and the CA will issue it. ESC8 is a Web Enrollment endpoint that accepts NTLM authentication without relay protection. An attacker who can coerce a server into authenticating to a machine they control can relay that authentication to the endpoint and enroll as the server.
Microsoft’s report stresses that a certificate is a durable authentication path. Resetting the user’s password or reimaging the first workstation does not revoke an issued certificate, and revoking the certificate does not invalidate Kerberos tickets that were already issued. On internal penetration tests, we find ESC1 templates and NTLM-accepting enrollment endpoints regularly, often left over from a default install or a template someone cloned years ago. The tools to find and abuse them are public and easy to use.
What Defenders Should Fix
Start with templates. Review every authentication-capable template for requester-supplied subject names and broad enrollment permissions, then remove enrollment rights nobody needs and require manager approval where a template must stay flexible. Next, inventory your Web Enrollment and Certificate Enrollment Web Service endpoints and remove the ones you do not use. Require HTTPS with Extended Protection for Authentication on the ones that remain and disable NTLM on enrollment services where you can. Microsoft’s KB5005413 covers these settings. Turn on Certification Services auditing so you can see who requested which certificate.
Microsoft’s first case also shows the cost of a containment exclusion. Defender’s automated response restricted most of the compromised identities, but one privileged account had been excluded, and the attacker used it to reach a file server and copy data to an external SFTP destination. If an account cannot be contained automatically, someone has to own a manual step. If an unauthorized certificate was issued, revoke it and review active Kerberos tickets as a separate task.
On the human side, require employees to verify unsolicited support requests through a known internal channel before starting a remote session, and review Teams external access so unknown tenants cannot reach your users by default.
How Raxis Can Help
Our internal network penetration testing starts from the same place these attackers did, a foothold on one workstation, and shows how far it reaches. Our Active Directory penetration testing goes deeper on certificate templates and the enrollment endpoints that ESC8 depends on. Our phishing and vishing testing runs the help desk pretext against your own people, over Teams and the phone, so you learn who would hand over a Quick Assist code before an attacker asks. If your organization is looking to test these angles throughout the year, our continuous PTaaS service gives you on-demand access to testing as new exploits are discovered and when you want to test changes in your environment.
One phone call and one bad template is all it took. Contact Raxis to find out whether the same path exists in your domain.
