Teams impersonation split into two paths to privileged access
Microsoft Threat Intelligence investigated two intrusions that began with attackers impersonating IT over Teams and persuading users to grant Quick Assist access, then split into separate Active Directory Certificate Services (AD CS) abuse paths.
In one intrusion, attackers abused an ESC1-vulnerable certificate template to obtain authentication certificates for privileged accounts. In the other, PetitPotam caused a domain controller to authenticate to an attacker-controlled system; attackers relayed that authentication through AD CS Web Enrollment (ESC8) to obtain a certificate for the controller. The certificates let attackers authenticate as those identities without their passwords, so ending the remote session alone may not end their access.
Microsoft says automated containment restricted much of the first intrusion, but a privileged identity it did not cover remained usable and later supported data exfiltration. In the second, the customer isolated the workstation after alerts, and Microsoft saw no further progression. Where AD CS is in use, the exposure can reach beyond the initial endpoint to privileged identities and domain infrastructure.
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths | Microsoft Security Blog
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos.