In a report published October 30, 2026, Microsoft described two intrusions that began with help-desk impersonation through Teams and progressed to abuse of Active Directory Certificate Services (AD CS). Users were persuaded to grant remote access, primarily through Quick Assist. The certificate attacks followed different routes: a misconfigured template in one case, and an NTLM relay in the other. Microsoft attributed the activity to social engineering and insecure AD CS configurations, not a Teams software flaw. Microsoft’s investigation
Two different paths through AD CS
AD CS issues and manages certificates used for authentication. Microsoft described an ESC1 template-abuse path in the first intrusion and a PetitPotam/ESC8 relay path in the second.
| Case | Certificate-abuse path | Response and observed outcome |
| ESC1 | A misconfigured authentication template let requesters supply identity information and obtain certificates for privileged accounts. The first wave involved three users and one workstation; certificates were obtained for three privileged accounts. About 90 minutes later, a second wave targeted 16 users and another workstation, resulting in certificates for eight additional privileged accounts. | Defender attack disruption blocked more than 1,000 later SMB file-access and logon attempts. But one privileged identity was excluded from automatic containment and remained usable. The attacker later used it to access a file server and transfer data to an external SFTP destination. |
| PetitPotam and ESC8 | PetitPotam coerced a domain controller to authenticate over NTLM. The attacker relayed that authentication to AD CS Web Enrollment, obtained a certificate for the domain controller’s identity, then used certificate-based Kerberos authentication (PKINIT) to request a ticket-granting ticket. | Defender generated ESC8-related alerts, and the customer isolated the associated workstation. Microsoft observed no further progression after isolation. |
The first case shows why an exception to automated containment needs a separate response: although other activity was disrupted, the excluded privileged identity remained a route to the file server. In the second case, workstation isolation was followed by no further observed progression. Microsoft’s account of the two paths is summarized here:
What defenders can investigate
Microsoft’s four advanced-hunting query examples cover suspicious external Teams contacts and impersonation signals; Bun or Java execution from KB-prefixed staging paths; network activity from those runtimes to ports 80, 445, 636 or 88; and alerts involving NTLM relay, Certificate Services, PKINIT or Kerberos ticket requests.
Those signals are more useful in combination than as isolated matches. Microsoft advises tuning queries to an organization’s environment and investigating results alongside related activity. A runtime name or a query match alone is not proof of compromise. For endpoint review, Microsoft also points to context such as file paths, process relationships, remote-session activity and what happened next. Portable or renamed tools can make a filename a weak indicator on its own.
Response steps for support access and certificates
For the initial Teams contact, Microsoft recommends verifying unexpected support requests through known internal channels, reviewing whether external Teams access is needed, and limiting remote-support tools to approved workflows.
For AD CS, Microsoft advises reviewing authentication-capable certificate templates for requester-supplied identity information, overly broad enrollment permissions and weak issuance controls. It also recommends removing unnecessary Web Enrollment endpoints, requiring HTTPS and Extended Protection for Authentication (EPA), disabling NTLM on enrollment services where operationally feasible, and enabling certificate auditing. Microsoft’s NTLM relay mitigation guidance covers protections for AD CS.
If an unauthorized certificate has been issued, revoking it and updating revocation information are separate from reviewing Kerberos tickets that have already been issued. A password reset or workstation reimage does not revoke an issued certificate or invalidate existing tickets. Any identity or device excluded from automated containment needs a compensating manual response.
