Two Teams-to-AD CS intrusions show how certificate-backed access and response exclusions can preserve a route from one remote session to domain-wide impact.
Microsoft Security Research documented two human-operated intrusions that began with help-desk impersonation in Teams and reached Active Directory Certificate Services. In the first case, automated disruption restricted covered identities and blocked more than 1,000 SMB file-access attempts plus additional logons. One privileged identity was excluded from that containment. It remained usable and later supported file-server access and data exfiltration.
That sequence deserves the center of the incident report. Containment is complete only when every device, identity, issued certificate and active ticket has a verified disposition. An exception is an open route until a named responder closes it through a compensating action.
Microsoft documented an intrusion in which covered identities were restricted while one excluded privileged account remained available and later supported data exfiltration.
The remote session was the handoff
Both intrusions started with Teams messages and calls from actors impersonating IT or help-desk staff. Users were persuaded to grant interactive remote access, primarily through Quick Assist. The contact channel supplied credibility; the user-approved session supplied control.
The operators then placed an archive on the workstation and launched attacker-controlled code through portable Python, Bun or Java runtimes staged in user-writable locations. From there they collected host and network information and assessed the environment’s certificate infrastructure.
The report attributes entry to social engineering and insecure or overly permissive AD CS configurations. It does not attribute the activity to a named group, identify the victims or establish that every contacted user was compromised.
Both observed cases moved from help-desk impersonation and user-approved remote access into portable runtime execution and AD CS discovery.
Certificate issuance expanded the foothold
The first environment exposed an ESC1 path: an authentication-capable certificate template allowed a requester to supply identity information while broad enrollment rights and weak issuance controls made privileged impersonation possible.
During the first wave, the actors targeted three users, compromised one workstation and obtained certificates for three highly privileged accounts. About 90 minutes later they launched a larger wave against 16 users, compromised another workstation and obtained certificates for eight more privileged accounts.
An authentication certificate changes the response scope. Resetting the password on the first user account or rebuilding the first workstation does not revoke an issued certificate. Revoking that certificate also does not retroactively invalidate Kerberos tickets already issued from it. The password, certificate and ticket therefore require separate containment evidence.
Microsoft observed two certificate-abuse paths that produced authentication material for privileged identities and, in the second case, a domain-controller account.
One exclusion preserved the route to the data
Microsoft’s account separates two important facts in the first case. A privileged certificate was used for DCSync within seconds while containment was taking effect. Separately, the privileged account excluded from automated response remained available after other identities were restricted.
That excluded account later supported network and remote-interactive logons, access to a file server and execution of a renamed copy of Rclone. The tool copied data from a file share to an external SFTP destination. Microsoft did not disclose the victim, the full volume removed or an actor identity.
The operational failure is measurable: a known privileged route sat outside the response boundary without an immediately verified manual substitute. Every exclusion should create an incident task, an owner, a deadline and a required proof of closure. If the account cannot be disabled, the team still has to constrain its logon paths, isolate reachable systems, revoke issued authentication material and watch the route continuously.
The second case closed the active execution point
The second environment did not present the same ESC1 template. The operator instead used PetitPotam to coerce a domain controller into authenticating with NTLM, relayed that authentication to AD CS Web Enrollment and obtained a certificate for the domain-controller account. The certificate was then used for PKINIT to obtain a domain-controller ticket-granting ticket.
After certificate-relay alerts, the customer isolated the associated workstation. Microsoft observed no further progression after that action.
The comparison is useful because the initial pattern was similar while the response coverage differed. In the first case, a privileged identity remained outside containment and the intrusion continued to data theft. In the second, the active workstation was removed from the path and no additional progression was observed. The public evidence does not establish every factor that produced those outcomes, but it shows exactly where responders need to demand closure evidence.
Build a certificate-aware containment ledger
I would put one ledger on the incident bridge and require a row for every affected or potentially affected device, identity, certificate and ticket. Each row should record:
the owner, privilege and systems the object can reach;
the evidence that links it to the intrusion;
the issued certificate’s serial number, thumbprint, template, requester and issuance time;
whether automated containment covers it or an exclusion applies;
the manual compensating action, accountable responder and deadline;
the authoritative log that will prove the route was closed.
The investigation then has to connect evidence across Teams, remote-access timing, endpoint process lineage, directory activity, certificate requests, Web Enrollment logs and Kerberos authentication. A domain-controller identity authenticating to enrollment infrastructure from a different workstation is a particularly strong pivot for the ESC8 path described in the second case.
Containment should proceed as separate, testable actions: isolate the active execution point; restrict every compromised identity; revoke unauthorized certificates and publish updated revocation information; review existing ticket-granting and service tickets; terminate affected sessions; and verify that relying systems have consumed the revocation state.
Device isolation, identity restriction, certificate revocation and ticket review are separate containment actions with separate evidence requirements.
The preventive work is equally concrete. Review authentication templates for requester-supplied identities, broad enrollment and weak issuance controls. Inventory Web Enrollment endpoints, remove those that are unnecessary, require HTTPS and Extended Protection for Authentication, and reduce NTLM where the environment can support it. Preserve certificate-authority and Kerberos audit data long enough to reconstruct issuance and use.
The most dangerous response gap can be the object everyone already knows is excluded. Put that exception on the same timeline as the attack and keep it there until the compensating control is visible in evidence.