Teams help-desk impersonation to domain-controller identity: Microsoft traces two intrusions from a Quick Assist session to AD CS ESC1 certificates with DCSync, and to PetitPotam relayed to ESC8 Web Enrollment
Microsoft: Teams help-desk vishing into Quick Assist ended in AD CS certificates for privileged accounts and a DC
Defender actions
- In every forest with an enterprise CA, list the AD CS Web Enrollment and Certificate Enrollment Web Service endpoints that lack HTTPS and Extended Protection for Authentication and the certificate templates that accept requester-supplied identity with broad enrollment rights, because both intrusions turned a Quick Assist session into a certificate for a privileged identity.
Analysis
Microsoft Threat Intelligence describes two human-operated intrusions, not attributed to any threat actor, that began with an external Teams contact (across the broader activity Microsoft saw organisation-themed tenant names and support-style display names) who persuaded a user to open Quick Assist and read out the connection code; the activity did not exploit a Teams vulnerability. In the session the operator placed an archive in Downloads, extracted it into a newly created KB-prefixed folder under the user profile and started the payload with a portable Python, JavaScript or Java runtime, which ran host and network discovery and assessed AD CS (Microsoft Threat Intelligence, 2026-10-30).
In the first case a certificate template open to ESC1, where the requester supplies the identity, produced certificates for three privileged accounts, and about 90 minutes later for eight more after a second wave against 16 users; DCSync began within seconds of obtaining one privileged certificate. Defender's automated disruption blocked more than 1,000 SMB attempts, but a privileged account excluded from automated response stayed usable, reached a file server and ran a renamed Rclone that copied a share to an external SFTP destination (Microsoft Threat Intelligence, 2026-10-30). In the second case the operator used PetitPotam to make a domain controller authenticate to the attacker's host, relayed that NTLM authentication to an AD CS Web Enrollment endpoint, obtained a certificate from the Domain Controller template and used it for PKINIT to get a ticket-granting ticket for the controller's account; Defender raised ESC8 alerts and the customer isolated the workstation (Microsoft Threat Intelligence, 2026-10-30).
Triage: a help-desk Quick Assist session is routine; what separates this one is an external-tenant initiator with no matching ticket and an interpreter runtime launched from a newly created user-writable folder rather than a managed install path.
Cited evidence
The activity described here is not attributed to a specific threat actor.
Resetting the user’s password or reimaging the first workstation does not revoke an issued certificate or invalidate Kerberos tickets that have already been issued.
One privileged account was excluded from automated response, so containment did not apply to that identity.
Sources1
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.