Help Desk Impersonation to Domain Takeover: Inside the ESC1 and ESC8 AD CS Attack Chain
Executive Summary
In late October 2026, Microsoft Threat Intelligence documented two human-operated intrusions in which threat actors abused Microsoft Teams to impersonate IT help desk personnel, socially engineering users into granting remote desktop access via Quick Assist. Once inside, attackers staged portable Python, Bun, or Java runtimes, performed host and Active Directory reconnaissance, and exploited misconfigured Active Directory Certificate Services (AD CS) via ESC1 and ESC8 vulnerabilities. In Case 1, ESC1 template abuse yielded certificates for eight privileged accounts, enabling DCSync and subsequent data exfiltration via a renamed Rclone binary. In Case 2, PetitPotam coerced domain-controller NTLM authentication that was relayed to AD CS Web Enrollment (ESC8), converting a workstation foothold into a domain-controller Kerberos identity.
These incidents highlight an accelerating pattern of identity-based intrusions that bypass traditional perimeter controls entirely. As organizations expand hybrid and cloud environments, misconfigured certificate infrastructure combined with social-engineering entry vectors represents a critical, underdefended attack surface that incident responders and security architects must prioritize immediately.
Why This Matters Now
AD CS misconfigurations like ESC1 and ESC8 remain widespread across enterprise environments, and attackers are actively operationalizing them in combination with Teams-based social engineering. With certificate-backed Kerberos identities surviving password resets and reimaging, and partial containment exclusions leaving privileged routes open, organizations face durable privilege escalation that conventional endpoint controls cannot fully neutralize.
Attack Path Analysis
Threat actors impersonated IT help desk personnel via Microsoft Teams, socially engineering users into granting remote access through Quick Assist, then staged portable runtimes to execute attacker-controlled scripts and enumerate Active Directory Certificate Services. From that workstation foothold, they abused misconfigured AD CS templates (ESC1) or relayed domain-controller NTLM authentication to Web Enrollment (ESC8) to obtain privileged authentication certificates, enabling DCSync, Kerberos PKINIT, lateral movement to file servers, and ultimately data exfiltration via a renamed Rclone binary to an external SFTP destination.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers used Microsoft Teams messages and calls from organization-themed onmicrosoft.com tenants to impersonate IT support personnel, convincing users to open Quick Assist and share a connection code. This granted hands-on-keyboard remote access to the victim workstation without any malware attachment or CVE exploitation. During the session, the attacker placed an archive in the Downloads folder, created a KB-prefixed staging directory under the user profile, extracted the archive, and launched attacker-controlled code using a portable Python, Bun, or Java runtime.
MITRE ATT&CK® Techniques
Phishing: Spearphishing Voice
Phishing: Spearphishing via Service
Remote Access Software
Steal or Forge Authentication Certificates
Adversary-in-the-Middle
OS Credential Dumping: DCSync
Masquerading
Exfiltration Over Alternative Protocol
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Authenticator Management: Public Key-Based Authentication
Control ID: IA-5(2)
PCI DSS 4.0 – Management of System and Application Accounts
Control ID: Requirement 8.6.1
NYDFS 23 NYCRR 500 – Access Privileges and Management
Control ID: Section 500.07
DORA (EU Regulation 2022/2554) – ICT Security — Access Controls and Authentication Mechanisms
Control ID: Article 9(4)(c)
NIS2 Directive (EU 2022/2555) – Supply Chain and Access Security Measures
Control ID: Article 21(2)(i)
CISA ZTMM 2.0 – Identity Continuous Validation and Privileged Access Governance
Control ID: Identity Pillar — Advanced Maturity: Continuous Validation
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Identity-based AD CS abuse via ESC1/ESC8 threatens domain infrastructure; DCSync and certificate-backed privilege escalation expose Active Directory environments managing citizen data and inter-agency credentials under NIST.800-53 mandates.
Financial Services
Help desk impersonation enabling certificate-forged Kerberos authentication and Rclone-driven SFTP exfiltration directly endangers PCI.4.0 and NIST.CSF.PR.DS-5 compliance, threatening high-value financial account credentials and sensitive transaction records.
Health Care / Life Sciences
ESC8 NTLM relay yielding domain-controller certificates risks HIPAA.164.312(e)(1) violations; lateral movement across clinical workstations and exfiltration of patient records represent critical east-west traffic security and Zero Trust segmentation failures.
Information Technology/IT
Portable Bun/Java runtime staging, Teams help desk impersonation, and AD CS misconfiguration abuse directly compromise IT-managed Active Directory PKI environments, undermining Zero Trust segmentation and multicloud visibility controls across enterprise infrastructure.
Sources
- From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathshttps://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/Verified
- KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS)https://support.microsoft.com/help/5005413Verified
- Defender for Identity security assessment: Insecure AD CS certificate enrollment IIS endpoints (ESC8)https://learn.microsoft.com/defender-for-identity/security-posture-assessments/certificatesVerified
- Certified Pre-Owned: Abusing Active Directory Certificate Services - SpecterOpshttps://specterops.io/assets/resources/Certified_Pre-Owned.pdfVerified
- CISA Advisory: Implementing Phishing-Resistant MFAhttps://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdfVerified
- MITRE ATT&CK: Steal or Forge Authentication Certificates (T1649)https://attack.mitre.org/techniques/T1649/Verified
- MITRE ATT&CK: Spearphishing via Service (T1566.003)https://attack.mitre.org/techniques/T1566/003/Verified
- Teams security best practices for safer messaginghttps://learn.microsoft.com/microsoftteams/teams-security-best-practices-for-safer-messagingVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's success depended on unrestricted workstation-to-domain-controller reachability, unconstrained east-west SMB access, and an open outbound path for Rclone-based exfiltration. Enforcing identity-aware segmentation and controlled egress policies across those paths would likely have reduced the attacker's blast radius and slowed progression through each kill chain stage.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Workload-level segmentation policies could limit the compromised workstation's ability to reach internal infrastructure and reduce the attacker's initial foothold from spreading beyond the entry-point host.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the workstation's ability to reach AD CS Web Enrollment endpoints and reduce the reachable surface for NTLM relay attacks by limiting which workloads can initiate LDAPS and SMB sessions toward domain-controller infrastructure.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely reduce the attacker's ability to move freely from the compromised workstation to domain controllers and file servers, limiting how far credential-based access could propagate across internal network segments.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic visibility and policy control could reduce the attacker's ability to sustain outbound command-and-control sessions from workloads that have no legitimate need to communicate over those port combinations toward external or unrecognized destinations.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely reduce the attacker's ability to transfer large volumes of data to an unrecognized external SFTP destination, constraining the outbound path available to the renamed Rclone process from the file server.
Had earlier segmentation and egress controls reduced the attacker's east-west reachability and outbound transfer paths, the scope of file-share exposure and the volume of exfiltrated data would likely have been smaller, even if initial workstation compromise had already occurred.
Impact at a Glance
Affected Business Functions
- Active Directory Identity and Access Management
- Enterprise File Server Data and Document Management
- Domain Controller Infrastructure and Authentication Services
- IT Help Desk and Remote Support Operations
Estimated downtime: 3 days
Estimated loss: N/A
Confirmed data exfiltration of corporate file-server share contents via Rclone to an external SFTP destination in Case 1. The attacker selected files up to three years old across the share, excluding only executable, database, virtual-disk, media, temporary, and log file types, indicating broad collection of business documents, potentially including intellectual property, internal communications, financial records, and employee data. In Case 2, a domain-controller certificate and TGT were obtained, granting the attacker full domain-level authentication capability, which placed all domain-joined systems and privileged credentials at risk of further compromise prior to isolation. The combination of DCSync credential replication and file-server exfiltration suggests exposure of Active Directory credential hashes for potentially all domain accounts, along with an undetermined volume of sensitive enterprise documents.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation controls to enforce identity-based policy between workstations and AD CS infrastructure, ensuring that low-privileged workstation identities cannot submit certificate enrollment requests to Enterprise CA templates without explicit approval workflows and multi-factor issuance controls aligned with ZTMM.Network and NIST.800-53.AC-6.
- • Deploy East-West Traffic Security to monitor and restrict LDAPS, SMB, and EFSRPC flows between workstations and domain controllers or CA servers, enabling detection of PetitPotam-style NTLM coercion and lateral movement attempts before certificate issuance occurs, consistent with ZTMM.Network and NIST.800-53.SC-7.
- • Enable Egress Security and Policy Enforcement with FQDN-based filtering and data loss prevention controls to detect and block unauthorized outbound SFTP transfers initiated by renamed tools such as Rclone, preventing exfiltration to external destinations and aligning with ZTMM.Data, NIST.800-53.SC-18, and NIST.CSF.PR.DS-5.
- • Implement Multicloud Visibility and Control with centralized traffic observability to baseline normal identity-to-infrastructure interaction patterns and generate alerts on anomalous certificate enrollment requests, DCSync replication events, and remote-access tool behavior originating from unexpected process lineages, supporting ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6.
- • Ensure Cloud Firewall and Inline IPS controls inspect and restrict outbound connections from user endpoints on ports associated with SFTP, SMB, and identity protocol abuse, and validate that containment policies cover all privileged identities without exclusions so that automated disruption cannot be bypassed through a single unprotected account, aligning with ZTMM.Network, PCI.4.0.6.4.1, and NIST.800-53.SC-7.
