---
title: Hunt: Microsoft details two Teams help-desk intrusions that went from Quick Assist to AD CS certificates for privileged accounts (ESC1) and a domain controller (PetitPotam + ESC8), with KQL and IOCs | ctxsec
url: https://ctxsec.com/items/hunt-microsoft-teams-help-desk-quick-assist-adcs-esc1-esc8
description: "Microsoft Threat Intelligence describes two intrusions where attackers posing as IT support on Teams got users to start Quick Assist, staged portable Python, Bun or Java runtimes in KB-named AppData folders, then abused AD CS. In one, an ESC1 template yielded certificates for 11 privileged accounts, DCSync followed, and an account excluded from automatic disruption was used to copy file-share data out with a renamed Rclone. In the other, PetitPotam plus NTLM relay to Web Enrollment (ESC8) gave a domain-controller certificate and Kerberos PKINIT. The post includes hunting queries and three SHA-256 hashes."
status: "official (Microsoft Threat Intelligence blog, Oct 30); not attributed to a known actor"
published: 2026-11-02
---

> Microsoft Threat Intelligence describes two intrusions where attackers posing as IT support on Teams got users to start Quick Assist, staged portable Python, Bun or Java runtimes in KB-named AppData folders, then abused AD CS. In one, an ESC1 template yielded certificates for 11 privileged accounts, DCSync followed, and an account excluded from automatic disruption was used to copy file-share data out with a renamed Rclone. In the other, PetitPotam plus NTLM relay to Web Enrollment (ESC8) gave a domain-controller certificate and Kerberos PKINIT. The post includes hunting queries and three SHA-256 hashes.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-microsoft-teams-help-desk-quick-assist-adcs-esc1-esc8.md)

official (Microsoft Threat Intelligence blog, Oct 30); not attributed to a known actor

2026-11-02

### Hunt: Microsoft details two Teams help-desk intrusions that went from Quick Assist to AD CS certificates for privileged accounts (ESC1) and a domain controller (PetitPotam + ESC8), with KQL and IOCs

Microsoft's **Oct 30** post covers two hands-on-keyboard intrusions that shared an entry path and split at the certificate layer. No Teams vulnerability was used.

- **Entry:** Teams chats and calls from organization-themed `onmicrosoft.com` tenants with support-style display names; the user opens **Quick Assist** and reads out the code.
- **Staging:** an archive dropped in Downloads, extracted to a new `%AppData%\Roaming\KB<digits>\` folder, and run with a portable **Python**, **Bun** (renamed, but still carrying Bun version metadata) or **Java** runtime, followed by `ipconfig /all`, `tasklist`, LDAPS and SMB to domain infrastructure.
- **Case 1 (ESC1):** a template that lets the requester supply the subject gave certificates for 3, then 8 more, privileged accounts across two waves 90 minutes apart. DCSync ran within seconds. Defender attack disruption blocked over 1,000 later SMB and logon attempts, but one privileged account excluded from automatic response was used to run Rclone renamed as `SearchApp.exe` and copy a file share to an external SFTP server.
- **Case 2 (ESC8):** PetitPotam coerced the DC's machine account to authenticate; the NTLM login was relayed to `/certsrv` Web Enrollment, a Domain Controller template certificate was issued, and PKINIT returned a TGT for the DC. The customer isolated the workstation after ESC8 alerts.

**Hunt for:** external Teams chats or `TeamsImpersonationDetected` events followed by Quick Assist; `bun.exe`/`java.exe` (check original file name, not just the name on disk) running `.js` or `.java` from `AppData\Roaming\KB*` and connecting to ports 88, 445 or 636; certificate requests where the SAN names a different, privileged account; a DC machine account authenticating to the CA from a non-DC host; PKINIT logons for machine accounts from workstations; Rclone-like command lines under other names. IOCs (SHA-256): `85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17` (JavaScript), `f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001` and `06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7` (Python).

**Fix:** remove enrollee-supplied subject from authentication templates or require manager approval, enable EPA and require HTTPS on Web Enrollment or turn it off (KB5005413), enable Certification Services auditing, restrict Teams external access to allowlisted domains, and treat every automatic-containment exclusion as an incident decision with a manual follow-up. Revoking a certificate does not kill Kerberos tickets already issued.

Sources: [Microsoft Security Blog: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Oct 30)](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/) · [Microsoft KB5005413: Mitigating NTLM relay attacks on AD CS](https://support.microsoft.com/en-us/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429) · [The Hacker News (Nov 2)](https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html)