Microsoft Teams help desk impersonation and AD CS abuse

Microsoft observed intrusions where actors used Microsoft Teams to impersonate IT support, gaining interactive access via tools like Quick Assist. Following initial access, actors staged portable runtimes (Python, Bun, Java) in user-writable directories to facilitate host discovery and Active Directory Certificate Services (AD CS) exploitation. Confirmed abuse paths include ESC1 (certificate template misconfiguration) and ESC8 (NTLM relay to AD CS Web Enrollment), the latter involving PetitPotam to coerce authentication.

Attack Chain

1. Initial Access: Threat actors use Microsoft Teams to impersonate IT support via messages and calls.
2. Execution: The user is socially engineered into initiating a remote support session via Quick Assist.
3. Staging: Attackers place a compressed archive into the user's Downloads folder and extract payloads into a 'KB-' prefixed directory under the user profile.
4. Runtime Execution: Payloads are executed using portable runtimes (Python, Bun, Java) launched from user-writable locations.
5. Discovery: The actor performs internal host and network discovery and evaluates AD CS environments.
6. Escalation: Actors perform certificate abuse via ESC1 (template manipulation) or ESC8 (NTLM relay via PetitPotam) to obtain privileged identity certificates.
7. Persistence/Exfiltration: Obtained certificates are used for PKINIT or DCSync attacks to further compromise the environment.

Impact

Successful exploitation allows attackers to obtain authentication certificates for privileged identities. These certificates provide durable access independent of user passwords and bypass traditional password reset or workstation re-imaging remediation efforts.

Recommendation

• Audit AD CS certificate templates for ESC1-vulnerable settings (requester-supplied SAN, broad enrollment).
• Implement NTLM relay protections on AD CS Web Enrollment endpoints (e.g., Extended Protection for Authentication).
• Monitor for unusual processes executing from user profile directories (e.g., Python, Java, Bun).
• Configure alerts for atypical AD CS certificate enrollment activity and the use of PetitPotam-related techniques.
• Disable or restrict the use of Quick Assist for users who do not require it for their roles.
• Ensure all service identities and devices are included in automated incident containment policies to prevent exclusion-based persistence.