Microsoft is currently investigating two significant human-operated intrusions that exploited Microsoft Teams to impersonate IT support personnel, enabling attackers to socially engineer users into granting remote access. The incidents, which involved the use of Quick Assist for remote sessions, diverged in their exploitation of Active Directory Certificate Services (AD CS) for certificate-based authentication, leading to different outcomes in terms of data exfiltration and containment measures.
In the first case, attackers exploited a vulnerability in an Enterprise CA Security Configuration 1 (ESC1) certificate template to obtain authentication certificates for privileged accounts, subsequently performing DCSync to access sensitive data. In the second case, attackers utilized PetitPotam, a technique that coerces a Windows server to authenticate to an attacker-controlled system, allowing them to relay NTLM authentication to AD CS Web Enrollment (ESC8) and obtain a certificate for the domain-controller account. This method enabled certificate-based Kerberos authentication, significantly increasing the potential impact of the attack.
Attack Chain Overview
Both incidents began with phishing messages and calls via Teams, impersonating support personnel to persuade users to initiate a remote session. Once access was granted, attackers executed portable runtimes such as Python, Bun, or Java to perform host and network discovery and assess AD CS configurations. The shared initial access pattern transitioned into two distinct paths based on the certificate abuse techniques employed.
Case Analysis: ESC1 and ESC8 Exploitation
In Case 1, the attacker exploited the ESC1 vulnerability to request certificates for three privileged accounts. Although Microsoft Defender’s automated disruption targeted the compromised identities, one privileged account was excluded from containment, allowing the attacker to continue their operations and ultimately exfiltrate data using a renamed copy of Rclone.
Conversely, in Case 2, the attacker successfully relayed NTLM authentication to AD CS Web Enrollment using PetitPotam, obtaining a certificate for the domain-controller account. Following alerts generated by Microsoft Defender, the customer isolated the affected workstation, preventing further attack progression.
Mitigation Recommendations
To defend against such intrusions, organizations should implement several key strategies:
- Require users to verify unsolicited support requests through known internal channels before granting remote access.
- Review and restrict external access policies in Microsoft Teams to limit impersonation risks.
- Utilize application control measures to restrict unapproved portable runtimes and script execution from user-writable locations.
- Conduct regular audits of AD CS configurations to identify and remediate vulnerabilities related to certificate issuance and enrollment processes.
These incidents underscore the importance of robust security measures and user awareness in preventing social engineering attacks that exploit remote access tools and certificate services. Microsoft continues to provide guidance and detection capabilities through Microsoft Defender to help organizations mitigate these risks effectively.
For further insights into the investigation and mitigation strategies, refer to the detailed analysis provided by Microsoft Security here.
