Microsoft Threat Intelligence investigated an intrusion where attackers impersonated help desk staff over Microsoft Teams to trick a user into granting remote access, then leveraged AD CS misconfigurations ESC1 and ESC8 to forge certificates and move laterally across the environment.
Initial access through Teams social engineering
The attack began when a threat actor contacted an employee via Microsoft Teams, posing as internal IT support. The attacker convinced the target to install a legitimate remote monitoring and management tool, granting the adversary interactive control over the workstation without deploying custom malware. This social engineering tactic bypassed traditional endpoint defenses because the remote access software carried valid digital signatures and appeared in approved application inventories.
Once connected, the operator enumerated the local system and domain environment, identifying the presence of Active Directory Certificate Services. They focused on certificate templates configured with dangerous permissions that could be abused for privilege escalation. The reconnaissance phase included querying LDAP for template objects, checking enrollment rights, and validating which templates included client authentication extended key usage.
Telemetry showed the attacker used built-in Windows utilities and living-off-the-land binaries to avoid detection. This approach blended with normal administrative activity, allowing the intrusion to progress quietly toward the certificate abuse phase. Tools such as certutil, PowerShell, and native WMI queries left minimal forensic footprints while providing the attacker with a complete map of the PKI topology.
Exploiting ESC1 and ESC8 certificate template flaws
The adversary targeted two well-known AD CS misconfigurations: ESC1 and ESC8. ESC1 allows low-privileged users to enroll for certificates with client authentication extended key usage and a subject name they control, enabling impersonation of any domain account including administrators. The attacker located a vulnerable template where the Enroll permission was granted to Domain Users and the Subject Name was supplied in the request rather than built from Active Directory attributes.
ESC8 leverages the NTLM relay attack against the Certificate Authority Web Enrollment endpoint. By coercing a domain controller or privileged machine to authenticate to an attacker-controlled listener, the adversary relayed the authentication to the CA and obtained a certificate for a high-value account. The coercion technique likely involved PetitPotam or printer bug variants that force the target to initiate NTLM authentication toward an arbitrary server.
With valid certificates in hand, the attacker authenticated as privileged users via Kerberos PKINIT, obtaining Ticket Granting Tickets that provided persistent, stealthy access to domain resources without needing passwords. These TGTs allowed the adversary to request service tickets for any SPN, enabling lateral movement to file servers, databases, and management consoles while appearing as legitimate administrative traffic in Kerberos logs.
Detection and mitigation guidance
Microsoft recommends monitoring for anomalous certificate enrollment events, especially requests for templates with client authentication EKU where the requester differs from the subject. Event ID 4887 and CA audit logs are key sources for spotting ESC1 abuse. Security teams should correlate certificate requests with user behavior baselines and flag enrollments originating from non-admin workstations or unusual geographic locations.
To disrupt ESC8, organizations should enable Extended Protection for Authentication on the CA web enrollment interface and enforce EPA on all IIS endpoints. Blocking NTLM relay through channel binding and disabling HTTP on the enrollment site further reduces risk. Additionally, restricting the CA web enrollment site to HTTPS with valid server certificates and requiring client certificate authentication for sensitive operations adds defense-in-depth layers.
Hardening guidance includes removing dangerous permissions from certificate templates, requiring manager approval for sensitive enrollments, and deploying Microsoft Defender for Identity to detect Kerberos PKINIT anomalies and lateral movement patterns. Template remediation should follow the principle of least privilege: remove Enroll rights from Domain Users, set Subject Name to Build from AD, and require manager approval for any template granting client authentication or smart card logon EKUs.
What to do next
Review your AD CS template permissions this week, prioritize templates with client authentication EKU and low-privilege enrollment rights, and enable EPA on all CA web endpoints to close the ESC8 relay path. Schedule a PKI health assessment to inventory all templates, validate enrollment ACLs, and confirm that monitoring rules cover both ESC1 and ESC8 abuse patterns.
Source: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Azure).
