# Microsoft: fake Teams help desk calls led to AD CS certificates for privileged accounts and a domain controller

Source: https://startwithidentity.com/blog/2026-10-30-fake-teams-help-desk-calls-led-to-ad-cs-certificates-for-privileged-accounts/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

Microsoft described two intrusions on October 30 in which attackers posed as IT support on Microsoft Teams, talked employees into opening Quick Assist, then abused weak Active Directory Certificate Services (AD CS) settings. In the first, an ESC1 certificate template let the attacker request sign-in certificates for other accounts: three highly privileged accounts in a first wave, then eight more after a second wave reached 16 users about 90 minutes later. Within seconds of getting one, the attacker ran DCSync on a domain controller. Defender's automatic attack disruption restricted most identities, but one privileged account excluded from automated response stayed usable and later carried file-server data to an outside SFTP server. In the second case, PetitPotam coercion relayed to AD CS web enrollment (ESC8) produced a certificate for the domain controller itself, and isolating the workstation stopped it. Microsoft did not attribute the activity.

## Why it matters

A certificate survives the fixes defenders reach for first. Microsoft notes that resetting the password or reimaging the workstation "does not revoke an issued certificate or invalidate Kerberos tickets that have already been issued." The control that failed in the first case was an exclusion list: one account outside automated containment was the whole remaining path, and Microsoft's own summary is that "partial identity containment can reduce attack activity while still leaving a viable privileged route."

Audit templates that let the requester name the subject, enable Extended Protection for Authentication on web enrollment (KB5005413), and review which accounts sit outside automated response. [Microsoft Defender for Identity](https://startwithidentity.com/vendors/itdr/microsoft-defender-identity/) posture checks flag ESC1 and ESC8 exposure. Restrict external Teams access and approved remote-support tools; [Arctic Wolf counted 400-plus](https://startwithidentity.com/blog/2026-10-26-arctic-wolf-counts-400-fake-it-help-desk-intrusions-over-teams-external-chat/) of the same openings, and our essay [the help desk is the perimeter](https://startwithidentity.com/blog/help-desk-is-the-perimeter/) covers caller verification. The technique pages are [AD CS certificate template abuse](https://startwithidentity.com/techniques/adcs-certificate-template-abuse/) and [help desk social engineering](https://startwithidentity.com/techniques/help-desk-social-engineering/); [Certifried](https://startwithidentity.com/cves/cve-2022-26923/) is an older AD CS flaw in the same family.

Source: [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/)