What Happened
A client call can start with a Teams message and end with a domain controller in the attacker's hands. This EnterProtect AD CS vulnerability briefing covers an attack path Microsoft Security investigated: fake IT support on Microsoft Teams, remote access to employee PCs, and abuse of Active Directory Certificate Services (AD CS). For an MSP, the cost is incident response, downtime, and lost client trust. The first move is to assume help desk impersonation will reach your clients and to put certificate abuse controls in place before it does.
Microsoft Security published a blog post on October 30, 2026, describing how help desk impersonation led to remote access, malicious runtime execution, and AD CS abuse through authentication relay and Kerberos. Hackernews reported on November 2, 2026, that attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. The attackers then used insecure AD CS settings to obtain login certificates for privileged accounts, including one for a domain controller.
The path matters as much as the endpoint. A social engineering request is hard to catch with software alone, and certificate abuse is easy to miss once the attacker has a valid login. For an MSP, the exposure is not just one client. The same help desk habits often exist across every client environment.
Timeline
- October 30, 2026: Microsoft Security published a blog post, 'From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths.'
- November 2, 2026: Hackernews published an article reporting that attackers posed as IT support on Microsoft Teams and abused AD CS to steal company data.
Who Is Affected
Any organization that uses Microsoft Teams for support communication and runs Active Directory Certificate Services is in scope. The first target is an employee, not a server. Attackers used Teams impersonation to gain remote control of employee PCs, so any user who accepts a support request without verification is a potential entry point.
The second stage affects AD CS environments with insecure settings. Microsoft Security investigated ESC1 and ESC8 intrusion paths, which allowed the attackers to obtain login certificates for privileged accounts. That included a certificate for a domain controller, meaning the attacker reached the highest level of access in the environment.
Technical Details
No CVE was published with this report. The products involved are Microsoft Teams and Active Directory Certificate Services (AD CS). The sources do not name specific versions.
The attack vector, as described by Microsoft Security, started with help desk impersonation on Microsoft Teams, led to remote access and malicious runtime execution, and continued into AD CS abuse through authentication relay and Kerberos. Microsoft Security investigated ESC1 and ESC8 intrusion paths. Attackers used insecure AD CS settings to obtain login certificates for privileged accounts, including one for a domain controller.
EnterProtect AD CS Vulnerability: What This Means for MSPs
When an attacker obtains a certificate for a domain controller, they can impersonate any account in the domain. For an MSP, that is full control of a client environment and the start of data theft, ransomware, or a long recovery effort.
This path also begins with a person, not a missing patch. That means patching alone will not stop it. The controls that matter are identity verification, remote access limits, AD CS hardening, and the ability to restore a clean environment.
What MSPs Should Do
Act on the assumption that this attack path will reach one of your clients.
- Require out-of-band confirmation for every remote support request. A Teams message is not enough.
- Restrict remote control software to approved tools, approved accounts, and explicit sessions.
- Audit Active Directory Certificate Services, including certificate templates, enrollment permissions, and relay paths.
- Monitor for unusual certificate requests, Kerberos activity, and new privileged accounts.
- Enforce least privilege for help desk staff and service accounts so a single compromise does not become domain admin.
- Test backup and recovery regularly so you can restore a client from clean copies after an incident.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of client systems and data. EnterProtect recovery gets a client running again after an incident. EnterProtect vulnerability scanning finds exposed versions of software in the environments you manage.
These capabilities do not replace the controls listed above. They are the safety net when a client is hit: clean data to restore, a clear path back to operation, and visibility into software that may need attention.
Frequently Asked Questions
What Are ESC1 and ESC8 in AD CS Abuse?
ESC1 and ESC8 are intrusion paths in Active Directory Certificate Services. ESC1 involves certificate templates that let an attacker request certificates for another account. ESC8 involves relaying authentication to AD CS enrollment endpoints. Microsoft Security investigated both paths in this campaign.
How Did Attackers Use Microsoft Teams in This Attack?
Attackers posed as IT support on Microsoft Teams and talked employees into giving them remote control of their PCs. Microsoft Security described this as the first step in a path that led to remote access and AD CS abuse. Hackernews reported that Microsoft investigated two such intrusions.
How Can I Stop Help Desk Impersonation?
Treat any unsolicited support contact as suspect. Confirm the request through a second channel, such as a phone call or a known ticket system, before granting remote access. Limit remote control tools to approved accounts and require explicit session approval.
What Should I Check in Active Directory Certificate Services?
Review certificate templates for overly permissive enrollment rights and audit which accounts can request certificates. Block NTLM relay paths to enrollment endpoints and monitor for unusual certificate requests. Microsoft's investigation points to insecure AD CS settings as the step that turned remote access into privileged access.
What Should I Do If I Suspect Certificate Abuse?
Assume the attacker has privileged access and start incident response immediately. Preserve logs, revoke suspicious certificates, and rebuild affected systems from known-good backups. Bring in an incident response team if you have one.
Sources
- From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Microsoft Security)
- Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data (Hackernews)