Microsoft Security Research said on 30 October 2026 that it investigated two human-operated intrusions in which attackers used Microsoft Teams messages and calls to impersonate IT or help desk staff. Users were persuaded to approve interactive remote access, mainly through Quick Assist, after which the attackers staged portable runtimes and assessed Active Directory Certificate Services for certificate-based authentication paths.
The activity did not exploit a vulnerability in Teams. It relied on social engineering, remote-control approval by the user, and insecure or overly permissive Active Directory Certificate Services configurations. The cases matter because a short remote support session can become certificate-backed access to privileged identities and domain infrastructure.
Shared entry path
Both incidents began with Teams phishing messages and calls that impersonated support personnel. Across the wider activity, the attackers used organisation-themed onmicrosoft.com tenant names and support-oriented display names to make the external contact look familiar.
After the user approved the remote session, the attacker placed an archive in the user’s Downloads folder. Commands created a KB-prefixed staging directory under the user profile, extracted the archive, and launched the payload using a portable Python, Bun, or Java runtime.
The runtime and packaging changed between deployments. One JavaScript variant used a renamed executable that retained metadata identifying it as the Bun runtime. Another used a staged Java runtime to launch a Java source file.
File names alone are weak indicators in this pattern. The useful signal is a portable runtime launched from a newly created, user-writable directory after an unexpected remote support session, followed by script execution, discovery commands or connections to identity infrastructure.
The staged components queried Windows version information, network configuration and running processes. The compromised workstations also connected to domain infrastructure using Lightweight Directory Access Protocol over TLS and Server Message Block.
ESC1 and ESC8 paths
Active Directory Certificate Services can turn a certificate request into an authentication path that is independent of the password initially used in the compromise. Resetting the user’s password or rebuilding the first workstation does not revoke an issued certificate or invalidate Kerberos tickets that have already been issued.
The first case used Enterprise CA Security Configuration 1, known as ESC1. In this path, a low-privileged requester abuses a misconfigured authentication-capable certificate template that permits requester-supplied identity information and broad enrolment. If issuance controls are weak, the requester can obtain a certificate representing a privileged account.
The first phishing wave targeted three user accounts and compromised one workstation. From that foothold, the attacker found an ESC1-vulnerable template and obtained certificates for three highly privileged accounts.
Microsoft Defender attack disruption restricted the initially compromised user and the three certificate-compromised identities. Remote logons and SMB access were restricted, and active sessions were disconnected. One privileged account was excluded from automated response, so containment did not apply to that identity.
About 90 minutes later, the attacker launched a larger Teams phishing wave that targeted 16 users and compromised another workstation. The attacker again used the ESC1-vulnerable template and obtained certificates for eight additional privileged accounts. Attack disruption targeted the newly compromised user and the eight identities, blocking more than 1,000 later SMB file-access attempts and additional logon attempts.
Within seconds of obtaining one privileged certificate, the attacker authenticated to a domain controller and performed DCSync while containment was taking effect. Attack disruption limited further replication and follow-on use, but the operation had already started.
The excluded privileged account remained available. The attacker used it for network and remote-interactive logons, reached a file server, and launched a renamed copy of Rclone as SearchApp.exe. The command recursively copied data from a file-server share to an external Secure File Transfer Protocol destination, used 20 concurrent transfers, selected files up to three years old, and excluded several executable, database, virtual-disk, media, temporary and log file types.
The second case used Enterprise CA Security Configuration 8, known as ESC8. The ESC1 path was not available in that environment, so the attacker used PetitPotam to send requests over the Encrypting File System Remote Protocol. That caused the domain controller to authenticate to an attacker-controlled system using its machine account.
The attacker then relayed the domain controller’s New Technology LAN Manager authentication to Active Directory Certificate Services Web Enrollment. The enrolment endpoint accepted the relayed identity, allowing the attacker to request and retrieve a certificate using the Domain Controller template.
The source mismatch is the investigation point. A domain-controller machine account authenticated to the certificate service from another device, followed by certificate issuance and Public Key Cryptography for Initial Authentication. The attacker used the certificate to obtain a Kerberos ticket-granting ticket for the domain controller.
Response differences
The two outcomes differed because containment covered different parts of the active intrusion. In the ESC1 case, automated disruption restricted several compromised identities, but the excluded privileged account remained usable and later supported file-server access and data exfiltration.
In the ESC8 case, Microsoft Defender generated alerts related to the certificate abuse path. The customer isolated the workstation associated with certificate enrolment and Kerberos activity, and no further attack progression was observed after that isolation.
The operational lesson is narrow but significant. Automated containment is less useful if a compromised privileged identity or device is excluded without a manual compensating action. Certificate revocation and Kerberos ticket review also need to be handled separately, because revoking a certificate does not retroactively invalidate tickets already issued.
Investigation and hardening points
Investigators need to reconstruct the chain across collaboration, endpoint, identity and certificate systems. For Teams and remote access, that means identifying the external tenant, user interaction, call or chat timing, remote-session start, approved remote management process and child processes created during the session.
For runtime staging, the useful artefacts are newly created KB-prefixed or application-like folders, archive extraction, executable metadata, script operands, parent-child process relationships and later network activity. For directory interaction, endpoint and directory logs are needed to determine what the initiating process did, because TLS hides LDAP query content from passive network inspection.
For ESC1, defenders should review certificate request and issuance events, requester identity, subject and Subject Alternative Name values, template name, enrolment permissions and the first authentication performed with the issued certificate. For ESC8, they should correlate EFSRPC activity, outbound domain-controller authentication, the relay device, Web Enrollment access, Certificate Authority request and issuance records, and PKINIT from the originating workstation.
Microsoft’s mitigation guidance focuses on reducing support impersonation, constraining runtime-based execution and hardening Active Directory Certificate Services. Users should verify unsolicited support requests through a known internal channel before joining calls, sharing screens or starting remote control. Teams external-access and federation policies should be reviewed against business need.
Remote support software should be restricted to approved products, operators and workflows. Endpoint controls should alert when approved remote management tools extract archives, create interpreters or launch scripts from user-writable paths. Application control can restrict unapproved portable runtimes and script execution from those locations.
For Active Directory Certificate Services, authentication-capable templates should be reviewed for requester-supplied subject information, broad enrolment rights, weak issuance requirements and excessive certificate purpose. Unneeded Web Enrollment and Certificate Enrollment Web Service endpoints should be removed. Where endpoints remain, HTTPS and Extended Protection for Authentication help resist NTLM relay, and NTLM should be disabled where operationally feasible.
Defender coverage
Microsoft Defender XDR can connect collaboration, endpoint, identity, certificate and Kerberos signals when the relevant products and sensors are in place. The listed coverage includes Teams chat initiated by a suspicious external user, suspicious Teams chat involving remote management and dangerous commands, possible NTLM relay, suspicious AD CS misconfigured certificate template abuse, suspicious AD CS machine certificate issuance abuse, and suspicious certificate usage over Kerberos.
Security Copilot can assist analysts by summarising the Teams-to-remote-access sequence, reviewing staged runtime behaviour, correlating certificate alerts with affected identities and preparing containment tasks. The usefulness of that assistance depends on connected plugins, permissions and the evidence available in the incident.
When a Teams support impersonation can pass through Quick Assist into AD CS certificate issuance, tenant access policy, identity containment and certificate response become questions for ECS's Security topic, alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions and workshops give attendees room to compare controls for Teams external access, Defender detections, AD CS hardening and incident response decisions. Bring the support workflows, certificate templates and containment exceptions that would be difficult to assess from documentation alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.