Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In late 2026, Microsoft investigated two intrusions in which attackers impersonated IT help desk staff via Microsoft Teams, convincing employees to grant remote access through Windows Quick Assist. The threat actors then exploited misconfigured Active Directory Certificate Services (AD CS) — specifically ESC1 and ESC8 vulnerabilities disclosed in 2021 — to obtain authentication certificates for privileged accounts, including domain controllers. In the first case, a single privileged account excluded from automatic containment allowed the attacker to reach a file server and exfiltrate data to an external SFTP server using a renamed Rclone binary. The second case was contained after workstation isolation.

These intrusions underscore a dangerous convergence of social engineering, identity-based persistence, and misconfigured PKI infrastructure. As organizations accelerate cloud adoption and hybrid work, AD CS misconfigurations remain widespread, and Teams-based impersonation continues to scale — making identity hygiene and certificate auditing critical defensive priorities heading into 2027.

Why This Matters Now

AD CS misconfigurations like ESC1 and ESC8 remain unpatched in millions of on-premises environments running Windows Server 2019 and 2022, where Extended Protection for Authentication is not enabled by default. With Teams-based social engineering rising sharply and certificate-based credentials surviving password resets, partial containment gaps can leave enterprises persistently exposed long after an incident is declared resolved.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers used misconfigured AD CS templates to obtain authentication certificates, which remain valid independent of password changes. A certificate issued to a privileged account continues to authenticate the holder until it is explicitly revoked and any outstanding Kerberos tickets are also invalidated.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because attacker progression depended on unrestricted east-west reachability between workstations, domain infrastructure, and file servers, combined with uncontrolled outbound egress paths to external SFTP endpoints. By enforcing workload-level segmentation and identity-aware routing boundaries, CNSF would likely have constrained the blast radius of both the lateral movement and the data exfiltration stages even after initial foothold was established.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Workload-level segmentation policies would likely limit the compromised endpoint's reachability to internal infrastructure, reducing the scope of attacker-controlled pivot paths available from the initial foothold even before privilege escalation begins.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation policies would likely constrain the compromised workstation's direct reachability to AD CS enrollment endpoints and domain controller interfaces, reducing the attacker's ability to relay NTLM traffic or reach certificate enrollment services without traversing an enforced policy boundary.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to move freely from a compromised workstation to a file server over SMB, constraining lateral reachability and limiting how many internal resources remain accessible from a single pivot point even when valid credentials are in use.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized traffic visibility across the environment would likely surface anomalous outbound connections and unusual inter-workload communication patterns associated with obfuscated tooling, reducing the attacker's ability to maintain persistent control channels without generating observable traffic anomalies within the fabric.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policy enforcement would likely constrain the compromised workload's ability to establish outbound SFTP connections to arbitrary external destinations, reducing the viable exfiltration paths available to the attacker even when the transfer is conducted over an encrypted channel using a renamed binary.

Impact (Mitigations)

Had prior segmentation and egress controls constrained lateral reachability and outbound transfer paths, the residual impact would likely have been scoped to a smaller set of internal assets, reducing the volume of credential material reachable via DCSync and limiting the data accessible to the attacker from shared file infrastructure.

Impact at a Glance

Affected Business Functions

  • Active Directory Identity and Access Management
  • Privileged Account and Domain Controller Administration
  • Corporate File Sharing and Internal Data Repositories
  • IT Helpdesk and Remote Support Operations
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: N/A

Data Exposure

Active Directory credential hashes and Kerberos ticket-granting ticket material were exfiltrated via DCSync against a domain controller, granting attackers offline cracking capability for privileged account passwords across the enterprise. Corporate file share data of undisclosed volume was copied to an external attacker-controlled SFTP server using a renamed instance of Rclone, indicating potential exposure of sensitive internal documents, intellectual property, financial records, and employee data. Eight or more privileged account certificates were issued, including one for a domain controller, providing persistent authentication bypass that survives password resets. The scope of exfiltrated file share content was not disclosed by Microsoft, but access to a domain controller implies full domain compromise with potential for broad confidential data exposure across all connected systems.

Recommended Actions

  • • Deploy Zero Trust Segmentation and East-West Traffic Controls: Enforce identity-based microsegmentation policies (aligned with ZTMM.Network and NIST.800-53.AC-6) to prevent a compromised workstation from directly reaching domain controllers or file servers via SMB—lateral movement via T1021.002 and DCSync (T1003.006) should require explicit policy authorization, not implicit trust on the internal network.
  • • Enforce Egress Security and Policy Enforcement for Outbound Data Transfers: Implement FQDN-based egress filtering and outbound traffic policy enforcement (aligned with ZTMM.Data, NIST.CSF.PR.DS-5, PCI.4.0.3.5.1) to block or alert on unauthorized SFTP/SCP data transfers to unknown external destinations—a renamed Rclone binary exfiltrating to an attacker SFTP server would be detectable as an anomalous outbound flow to an unapproved destination.
  • • Apply Multicloud Visibility and Anomaly Detection Across Identity and Network Planes: Leverage centralized traffic observability and anomaly detection (aligned with ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to baseline normal authentication patterns and surface anomalous certificate enrollment requests, DCSync replication events, and bulk SMB file access—early detection of ESC1/ESC8 certificate abuse depends on correlating AD CS audit logs with network behavior.
  • • Enable Encrypted Traffic Inspection and IPS Signatures for Known Attack Tooling: Use inline IPS capabilities with Suricata-based signature detection (aligned with NIST.800-53.SI-4, PCI.4.0.6.4.1) to identify known malicious payload patterns associated with PetitPotam NTLM coercion, Quick Assist abuse scripts (SHA-256 hashes published by Microsoft), and Rclone exfiltration traffic where traffic is inspectable—complement with HPE controls to ensure legitimate encrypted channels are not used as blind exfiltration paths.
  • • Operationalize Cloud Native Security Fabric (CNSF) for Real-Time Inline Enforcement at Initial Access: Enforce inline policy at the network edge to detect and block anomalous remote access tool invocations and cross-tenant Teams communications patterns (aligned with ZTMM.CrossCutting.Automation, NIST.CSF.ID.RA-3)—ensure that any account excluded from automated containment workflows triggers an immediate compensating manual control action, as partial identity containment was the decisive factor enabling persistent privileged access in the first intrusion.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image