Microsoft Tracks Teams Support Calls to AD CS Certificates and Data Theft

Two intrusions investigated by Microsoft began with fake Teams help desk messages and user-approved remote support, primarily Quick Assist. The intruders staged portable runtimes and sought AD CS authentication certificates. One abused an ESC1-vulnerable template to obtain privileged certificates, reached DCSync, and later used an identity excluded from automated containment to take data from a file server. In the other, PetitPotam-triggered domain-controller authentication was relayed to Web Enrollment through ESC8; the attacker obtained a domain-controller certificate and a Kerberos ticket before the customer isolated the workstation. Microsoft observed no further progression after isolation.

Join Teams contact and remote-session times to endpoint archive extraction, KB-prefixed writable staging, portable Bun/Python/Java processes and CA requests. Check requester identity, template enrollment and supplied subject for ESC1; for ESC8, match domain-controller authentication from another device to IIS /certsrv logs, CA issuance and PKINIT. onmicrosoft.com is a shared tenant domain, so correlate a support-themed tenant with the user interaction. Microsoft’s relay guidance recommends EPA and HTTPS on enrollment endpoints; restrict overbroad authentication templates too. If certificates were issued without authorization, revoke them, publish revocation updates, review active Kerberos tickets and manually contain any excluded privileged account. Verify the endpoint settings and the certificate-to-account trail after changes.