Microsoft Teams IT Support Impersonation and AD CS ESC8 Abuse: Detection, Hardening, and Response Guide

Attackers are posing as IT support personnel on Microsoft Teams, convincing employees to grant remote control of their workstations, and then abusing insecure Active Directory Certificate Services (AD CS) configurations—specifically the ESC8 attack path—to request and obtain authentication certificates for privileged accounts, including domain controllers. Microsoft has confirmed it investigated at least two such intrusions in 2026, with at least one resulting in significant data exfiltration. This is not a theoretical threat: it is an active, human-operated intrusion vector that bypasses traditional perimeter defenses by exploiting trust in collaboration tools and legacy PKI misconfigurations.

Introduction

The convergence of social engineering and AD CS abuse represents one of the most dangerous attack patterns facing enterprise defenders in 2026. By impersonating internal IT support on Microsoft Teams, threat actors gain initial access without deploying malware or exploiting software vulnerabilities. Once an employee grants remote control—often via built-in Windows Quick Assist or third-party remote access tools—the attacker pivots to certificate-based persistence and privilege escalation. The ESC8 attack, which abuses Certificate Enrollment Web Services (CES) and Certificate Authority Web Enrollment, allows low-privileged users to request certificates for arbitrary accounts, including high-value targets like domain controllers. Because certificate authentication is often treated as highly trusted by Active Directory, this technique frequently bypasses MFA and conditional access policies.

Microsoft's investigation into two separate intrusions confirms that this is not isolated experimentation but a repeatable, scalable intrusion methodology. At least one victim suffered confirmed data theft. Organizations running hybrid or on-premises Active Directory with AD CS deployed—particularly those with web enrollment enabled—are at immediate risk. Defenders must treat unsolicited IT support contact on Teams as a potential intrusion vector and audit their certificate services infrastructure for ESC8 exposure without delay.

Technical Analysis

Affected Products and Platforms

This attack chain targets Microsoft environments with the following components:

• Microsoft Teams: Used as the social engineering delivery platform. Attackers create external or guest accounts that mimic internal IT support branding and display names.
• Windows 10/11 and Windows Server: Target endpoints where remote control is granted.
• Active Directory Certificate Services (AD CS): Specifically, deployments with Certificate Enrollment Web Services (CES) or Certificate Authority Web Enrollment enabled. The ESC8 attack abuses HTTP-based certificate enrollment interfaces that do not enforce HTTPS or that allow NTLM authentication.
• Quick Assist / Remote Assistance: Built-in Windows tools frequently abused for remote control, though third-party tools like AnyDesk, TeamViewer, or ScreenConnect may also be used.

No specific CVE identifier is associated with this campaign. The vulnerability is not a software bug but a architectural misconfiguration in AD CS combined with social engineering. ESC8 has been a known attack path since at least 2021, but it remains widely exploitable in 2026 due to the persistence of legacy certificate enrollment configurations.

How the Attack Works

The intrusion follows a predictable, multi-stage chain:

1. Initial Contact: The attacker initiates a Teams chat or call with an employee, using display names like "IT Help Desk," "Microsoft Support," or spoofed internal technician names. They claim the user's device requires urgent maintenance, a security update, or license reactivation.

2. Remote Access Establishment: The employee is guided to launch Quick Assist (built into Windows) or download a remote access tool. The attacker requests the security code and establishes full interactive control of the session.

3. Reconnaissance: With remote control, the attacker maps the internal network, identifies domain controllers, and queries AD CS configuration using tools like Certify.exe or certutil.exe. They specifically look for ESC8-vulnerable enrollment endpoints.

4. ESC8 Exploitation: The attacker locates a Certificate Authority with web enrollment enabled (typically accessible via http://<CA>/certsrv or https://<CA>/certsrv). If the CA accepts NTLM authentication and does not enforce EPA (Extended Protection for Authentication) or HTTPS, the attacker relays authentication to request a certificate. Critically, they can specify an arbitrary Subject Alternative Name (SAN), allowing them to request a certificate for a privileged account—such as a Domain Admin or the domain controller machine account itself.

5. Persistence and Exfiltration: The issued certificate is used with tools like Rubeus or Certipy to request Kerberos TGTs, enabling pass-the-certificate attacks. The attacker moves laterally, accesses sensitive data, and exfiltrates it before detection. Because certificate authentication is often exempt from interactive logon restrictions, this phase is frequently invisible to traditional monitoring.

Exploitation Status

This is a confirmed, actively exploited intrusion vector as of November 2026. Microsoft has published details of two investigations, and security researchers have observed similar TTPs across multiple sectors. While no CVE exists, the technique is documented in MITRE ATT&CK as T1649 (Steal or Forge Authentication Certificates) and T1550.003 (Use Alternate Authentication Material: Pass the Ticket). CISA has not issued a KEV entry for ESC8 specifically, as it is a configuration weakness rather than a patchable vulnerability, but it is referenced in CISA's AD CS hardening guidance.

Detection & Response

This is a technical threat requiring multi-layer detection across identity, endpoint, and network telemetry. The following rules and queries are designed to surface the specific behaviors observed in this campaign.

Sigma Rules

---
title: Suspicious Quick Assist Execution from User Profile
id: 8f2a9c41-7b3e-4d12-a9f5-2c8e6d1b4a7f
status: experimental
description: Detects Quick Assist launched from non-standard paths or with suspicious command-line arguments, often seen in IT support impersonation attacks.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\quickassist.exe'
  selection_path:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
  selection_cli:
    CommandLine|contains:
      - '/q'
      - '/quiet'
      - '/elevate'
  condition: selection_img and (selection_path or selection_cli)
falsepositives:
  - Legitimate help desk activity (rare in most environments)
level: high
---
title: Certificate Request via Web Enrollment with Suspicious SAN
id: 3c7d5e89-2f4a-4b67-9c1d-8e5f3a2b6c9d
status: experimental
description: Detects certificate enrollment requests submitted via HTTP/HTTPS web enrollment interfaces containing high-privilege account names in the Subject Alternative Name field.
references:
  - https://attack.mitre.org/techniques/T1649/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.credential_access
  - attack.t1649
  - attack.t1550.003
logsource:
  category: webserver
  product: windows
  service: iis
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/certsrv/'
      - '/certsrv/certfnsh.asp'
      - '/certsrv/certnew.cer'
  selection_method:
    cs-method: 'POST'
  selection_san:
    cs-uri-query|contains:
      - 'SAN%3a'
      - 'san%3a'
      - 'upn%3d'
      - 'dns%3d'
  condition: selection_uri and selection_method and selection_san
falsepositives:
  - Legitimate certificate auto-enrollment (typically uses RPC, not HTTP)
  - Internal PKI administration
level: critical
---
title: Certify or Certipy AD CS Enumeration
id: 5e9f1a34-6c8d-4e23-b7f1-9d3c5a7e2b8f
status: experimental
description: Detects execution of common AD CS reconnaissance and abuse tools used to identify ESC8-vulnerable certificate authorities.
references:
  - https://attack.mitre.org/techniques/T1649/
author: Security Arsenal
date: 2026/11/15
tags:
  - attack.discovery
  - attack.t1649
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\certify.exe'
      - '\certipy.exe'
      - '\certutil.exe'
  selection_cli:
    CommandLine|contains:
      - 'find /vulnerable'
      - 'request /ca:'
      - 'auth /pfx:'
      - 'cas'
      - 'find /enrolleeSuppliesSubject'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate PKI administration by authorized staff
level: high

KQL (Microsoft Sentinel / Defender)

The following query hunts for the full attack chain: remote access tool execution followed by AD CS enumeration or certificate request activity.

// Hunt for Quick Assist execution followed by AD CS reconnaissance within 30 minutes
let TimeWindow = 30m;
let QuickAssistEvents = DeviceProcessEvents
| where FileName =~ "quickassist.exe"
| where ProcessCommandLine has_any ("/q", "/quiet", "/elevate") or InitiatingProcessFileName != "explorer.exe"
| project QuickAssistTime = TimeGenerated, DeviceId, DeviceName, AccountName, QuickAssistCommandLine = ProcessCommandLine;
let ADCSEvents = DeviceProcessEvents
| where FileName in~ ("certify.exe", "certipy.exe", "certutil.exe")
| where ProcessCommandLine has_any ("find", "request", "auth", "cas", "enrolleeSuppliesSubject", "vulnerable")
| project ADCSTime = TimeGenerated, DeviceId, DeviceName, ADCSCommandLine = ProcessCommandLine;
QuickAssistEvents
| join kind=inner ADCSEvents on DeviceId
| where ADCSTime between (QuickAssistTime .. QuickAssistTime + TimeWindow)
| project QuickAssistTime, ADCSTime, DeviceName, AccountName, QuickAssistCommandLine, ADCSCommandLine
| order by QuickAssistTime desc

// Hunt for certificate requests to privileged accounts via web enrollment
SecurityEvent
| where EventID == 4886 or EventID == 4887 // Certificate Services received/request issued
| where SubjectUserName !endswith "$" and SubjectUserName != "ANONYMOUS LOGON"
| where Attributes has "san:upn=" or Attributes has "san:dns="
| extend TargetAccount = extract(@"san:upn=([^\s&]+)", 1, Attributes)
| where TargetAccount has_any ("administrator", "admin", "krbtgt", "dc", "domain") or TargetAccount endswith "$"
| project TimeGenerated, Computer, SubjectUserName, TargetAccount, Attributes, IpAddress
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts for evidence of remote access tools and AD CS abuse artifacts on endpoints.

-- Hunt for Quick Assist execution and AD CS tool artifacts
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    hash(path=Exe) AS BinaryHash
FROM pslist()
WHERE 
    Name =~ 'quickassist|certify|certipy|certutil'
    AND (
        CommandLine =~ 'find|request|auth|cas|vulnerable|enrolleeSuppliesSubject'
        OR Exe =~ 'Users|Temp|ProgramData'
    )

-- Hunt for recently issued certificate files in user profiles
SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime,
    hash(path=FullPath) AS FileHash
FROM glob(globs='C:\\Users\\*\\*.pfx')
WHERE Mtime > ago(7d)

Remediation Script

The following PowerShell script hardens AD CS against ESC8 and audits for suspicious certificate requests.

# AD CS ESC8 Hardening and Audit Script
# Run on Certificate Authority servers with Enterprise Admin privileges

# 1. Enforce HTTPS on CES and Web Enrollment
Write-Host "[+] Enforcing HTTPS on Certificate Enrollment Web Services..." -ForegroundColor Green
Import-Module WebAdministration
$CESPaths = @("CertEnroll", "CertSrv")
foreach ($Path in $CESPaths) {
    $Site = Get-Website | Where-Object { $_.Name -eq "Default Web Site" }
    $Binding = Get-WebBinding -Name $Site.Name -Protocol "http"
    if ($Binding) {
        Remove-WebBinding -Name $Site.Name -Protocol "http" -Port 80
        Write-Host "    Removed HTTP binding for $($Site.Name)" -ForegroundColor Yellow
    }
    # Ensure HTTPS binding exists with valid cert
    $HTTPSBinding = Get-WebBinding -Name $Site.Name -Protocol "https"
    if (-not $HTTPSBinding) {
        Write-Host "    WARNING: No HTTPS binding found. Configure a valid SSL certificate." -ForegroundColor Red
    }
}

# 2. Disable NTLM authentication on enrollment endpoints (use Kerberos only)
Write-Host "[+] Configuring authentication to reject NTLM..." -ForegroundColor Green
$AuthPaths = @("CertSrv", "CertEnroll")
foreach ($Path in $AuthPaths) {
    $ConfigPath = "IIS:\Sites\Default Web Site\$Path"
    Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/windowsAuthentication" `
        -Name "enabled" -Value $true -PSPath $ConfigPath
    Set-WebConfigurationProperty -Filter "/system.webServer/security/authentication/anonymousAuthentication" `
        -Name "enabled" -Value $false -PSPath $ConfigPath
}

# 3. Enable Extended Protection for Authentication (EPA)
Write-Host "[+] Enabling Extended Protection for Authentication..." -ForegroundColor Green
$CESConfig = Get-WebConfiguration -Filter "/system.webServer/security/authentication/windowsAuthentication" `
    -PSPath "IIS:\Sites\Default Web Site\CertSrv"
$CESConfig.extendedProtection.tokenChecking = "Require"
$CESConfig.extendedProtection.flags = "None"
$CESConfig | Set-WebConfiguration -Filter "/system.webServer/security/authentication/windowsAuthentication" `
    -PSPath "IIS:\Sites\Default Web Site\CertSrv"

# 4. Audit recent certificate requests for suspicious SANs
Write-Host "[+] Auditing certificate requests for privileged account SANs..." -ForegroundColor Green
$SuspiciousRequests = certutil -view -restrict "RequesterName!=NT AUTHORITY\SYSTEM" `
    -out "RequestID,RequesterName,CommonName,SAN,RequestType,RequestDate" 2>$null
if ($SuspiciousRequests) {
    $Lines = $SuspiciousRequests -split "`n"
    foreach ($Line in $Lines) {
        if ($Line -match "administrator|admin|krbtgt|dc\$|domain") {
            Write-Host "    SUSPICIOUS: $Line" -ForegroundColor Red
        }
    }
}

# 5. Enable audit policy for certificate services
Write-Host "[+] Enabling Certificate Services audit policy..." -ForegroundColor Green
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable

# 6. Disable web enrollment if not required
$DisableWebEnrollment = Read-Host "Do you want to DISABLE web enrollment entirely? (Recommended if not required) [Y/N]"
if ($DisableWebEnrollment -eq "Y") {
    Write-Host "[+] Disabling AD CS Web Enrollment role..." -ForegroundColor Yellow
    Uninstall-WindowsFeature ADCS-Web-Enrollment -Confirm:$false
    Write-Host "    Web Enrollment removed. Reboot required." -ForegroundColor Green
}

Write-Host "[+] Hardening complete. Review output for warnings." -ForegroundColor Green

Remediation

Immediate actions to break the attack chain:

1. Disable or Restrict AD CS Web Enrollment: If Certificate Enrollment Web Services (CES) or CA Web Enrollment are not operationally required, remove the role entirely. If required, enforce HTTPS with a valid certificate, disable HTTP bindings, and require Kerberos-only authentication (disable NTLM).

2. Enable Extended Protection for Authentication (EPA): On all certificate enrollment endpoints, set EPA to Require. This prevents NTLM relay attacks by binding the authentication to the TLS channel.

3. Audit Certificate Templates: Review all templates for the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag. Disable this flag unless absolutely necessary. Ensure that only authorized security groups can enroll in templates that allow authentication.

4. Monitor Certificate Issuance: Alert on Event IDs 4886 (certificate request received) and 4887 (certificate issued) where the SAN contains high-privilege account names (e.g., administrator, krbtgt, domain controller machine accounts). Use the KQL queries above for continuous monitoring.

5. Control Remote Access Tools: Use AppLocker or Windows Defender Application Control (WDAC) to restrict Quick Assist, AnyDesk, TeamViewer, and ScreenConnect to approved IT support accounts only. Block execution from user-writable directories.

6. Microsoft Teams Hardening:

   • Disable external access (federation) unless business-required
   • If required, restrict to specific allowed domains
   • Enable Teams safety reports to alert users when a message is from an external sender
   • Train users to verify IT support contact via a separate channel (phone call to known internal number)

7. Privileged Access Workstations (PAWs): Require that all administrative tasks, including certificate management, be performed from dedicated PAWs with no internet access and no email/Teams clients.

8. Network Segmentation: Isolate AD CS servers from general user VLANs. Restrict access to enrollment endpoints to authorized PKI administrators and auto-enrollment infrastructure only.

No vendor patch exists for ESC8—it is a configuration weakness. Microsoft's guidance is published in KB5014754 (certificate mapping hardening) and the AD CS security guidance. CISA recommends reviewing Securing PKI for comprehensive hardening steps.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub