Investigating Dual-Path AD CS Intrusions: From Social Engineering to Certificate Abuse
Modern identity-based attacks are increasingly leveraging a sophisticated combination of social engineering and technical exploitation of Active Directory Certificate Services (AD CS). Recent investigations into human-operated intrusions have highlighted a dangerous attack chain where threat actors use Microsoft Teams to impersonate IT support personnel, ultimately gaining the persistent, certificate-based access required to compromise domain infrastructure. These incidents underscore the critical need for organizations to secure both their human and technical perimeters.
The Anatomy of an Impersonation-Led Attack
The observed attack pattern begins with deceptive communication. Attackers initiate contact via Microsoft Teams, using support-themed display names and spoofed external tenant identities to gain the trust of employees. By posing as help desk staff, the threat actors convince users to initiate remote support sessions, typically through tools like Quick Assist. Once a user grants remote access, the attacker gains hands-on-keyboard control, which they use to deploy portable runtimes—such as Python, Bun, or Java—from user-writable directories. These runtimes are used to execute scripts that perform host discovery and assess the environment for AD CS vulnerabilities.
Divergent Paths: ESC1 and ESC8 Exploitation
While the initial entry remains consistent, the technical escalation paths diverge based on the specific AD CS misconfigurations present in the target environment. In one scenario, attackers exploited the ESC1 vulnerability. This occurs when a certificate template is misconfigured to allow the requester to specify their own Subject Alternative Name (SAN) and has broad enrollment rights. By abusing this, an attacker can request a certificate for any privileged account, effectively bypassing traditional password-based security.
In a second scenario, the intruders employed the ESC8 technique. This method involves using PetitPotam to coerce a domain controller into authenticating to an attacker-controlled system via the Encrypting File System Remote Protocol (EFSRPC). The attacker then relays this NTLM authentication to the AD CS Web Enrollment interface. Because the endpoint lacks sufficient relay protections, the attacker can successfully request a certificate as the domain controller. This certificate is then used to perform PKINIT (Public Key Cryptography for Initial Authentication), granting the attacker a durable Kerberos identity.
Response Outcomes and Strategic Mitigation
The impact of these intrusions depends heavily on the efficacy of the automated response and the absence of configuration gaps. In the ESC1 incident, while automated disruption successfully restricted many compromised identities, an exclusion of a privileged account left a critical gap. The attacker exploited this remaining access to facilitate data exfiltration. Conversely, in the ESC8 case, timely detection led to device isolation, which effectively halted the progression of the attack.
Defenders must move beyond monitoring individual files or port activity. Effective investigation requires correlating remote access sessions with subsequent directory interactions and certificate issuance records. To mitigate these risks, organizations should enforce strict identity verification policies for all support requests, limit external federation in collaboration platforms, and rigorously audit AD CS configurations to ensure that templates and web endpoints are hardened against unauthorized enrollment and relay attacks.
