Help-Desk Impersonation → AD CS Certificate-Backed Identity Takeover
Status
PASS
Verified Findings
None
Contradictions / Caveats
UNKNOWN: Two human-operated intrusions began with Teams help-desk impersonation and user-approved remote access, primarily Quick Assist; portable runtimes then assessed AD CS before branching into ESC1 or ESC8 certificate-abuse paths.
Evidence boundary: Actor identity, broad prevalence, or a Microsoft Teams vulnerability.
UNKNOWN: ESC1 template abuse yielded privileged authentication certificates; DCSync occurred, and one privileged identity excluded from disruption remained usable and later supported file-server access and data exfiltration.
Evidence boundary: ESC1 prevalence or universal failure of automated disruption.
UNKNOWN: PetitPotam coerced domain-controller NTLM authentication, relayed it to AD CS Web Enrollment, obtained a DC certificate and used PKINIT/Kerberos authentication; no further progression was observed after customer-led workstation isolation.
Evidence boundary: Universal sufficiency of workstation isolation or shared campaign identity.
UNKNOWN: Microsoft has long documented PetitPotam/NTLM relay risk against AD CS Web Enrollment/CES and recommends EPA plus disabling HTTP/NTLM where feasible.
Evidence boundary: The 2026 incidents or current exploitation prevalence.
UNKNOWN: Current Microsoft guidance describes ESC8 insecure enrollment endpoints as capable of complete domain takeover and ESC1 templates as allowing arbitrary-user certificate requests when dangerous conditions align, with explicit remediations.
Evidence boundary: Representative prevalence or linkage to a specific customer incident.
UNKNOWN: Original AD CS research documented ESC1–ESC8 abuse classes and certificate-backed credential/persistence implications, including survival across password changes.
Evidence boundary: The 2026 Microsoft incidents or representative current prevalence.
UNKNOWN: Canadian Cyber Centre reports an ongoing help-desk vishing campaign against multiple organizations using branded AiTM sign-in pages to relay credentials/MFA, obtain sessions, register MFA methods and exfiltrate cloud data.
Evidence boundary: Any link to Microsoft's AD CS incidents, same actor, or AD CS abuse in Canada.
Open Follow-up
OPEN [HIGH]: CAMPAIGN_IDENTITY_SCALE — No independent public incident origin currently corroborates the exact Microsoft help-desk/Quick Assist→AD CS ESC1/ESC8 chain; actor identity, victim denominator and campaign prevalence remain unresolved.
OPEN [MEDIUM-HIGH]: EXPOSURE_CONTROL_OUTCOME — No representative denominator establishes current enterprise prevalence of exploitable ESC1/ESC8 configurations, and no multi-environment dataset measures certificate-aware containment outcomes.
Sources
Microsoft Security Researchhttps://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/
Microsoft Supporthttps://support.microsoft.com/en-us/servicing/os/windows-server/2021/07/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs
Microsoft Learnhttps://learn.microsoft.com/en-us/defender-for-identity/security-posture-assessments/certificates
Canadian Centre for Cyber Securityhttps://www.cyber.gc.ca/en/alerts-advisories/al26-028-ongoing-help-desk-voice-phishing-campaign-targeting-canadian-organizations