Affected Systems

Organizations using Microsoft Teams with external tenant access enabled and Active Directory Certificate Services (AD CS) with insecure certificate templates (ESC1, ESC8). All Windows environments with AD CS web enrollment endpoints vulnerable. No specific product versions identified.

Exploitation Status

Active exploitation confirmed. Microsoft investigated two successful intrusions resulting in data exfiltration. Techniques (ESC1, ESC8, PetitPotam) are well-documented and publicly known. No attribution to named threat actor.

Business Impact

Attackers gained domain controller access and extracted Active Directory credentials via DCSync in one case, and exfiltrated company data to external SFTP server using Rclone. Malicious certificates remain valid after password resets and system wipes, enabling persistent access. Partial identity containment in first case left one privileged account active, allowing continued lateral movement despite automated response blocking 1,000+ subsequent access attempts.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all AD CS certificate templates for ESC1 (user-specified SAN) and remove unnecessary enrollment permissions; use Microsoft Defender for Identity posture assessments to identify vulnerable templates
  • Enable Extended Protection for Authentication (EPA) on AD CS web enrollment endpoints per KB5005413, enforce HTTPS, and disable NTLM authentication where possible to prevent ESC8 relay attacks
  • Restrict external Microsoft Teams tenant access to approved organizations only and disable Quick Assist or limit to authorized remote support tools via Group Policy
  • Enable certificate request auditing (Event IDs 4886, 4887) and monitor for certificate issuance to privileged accounts or domain controllers
  • Review automatic attack disruption exclusions in Microsoft Defender; ensure all privileged accounts are included or have documented manual containment procedures
  • Train staff to verify unexpected IT support contact through known internal channels before granting remote access; never share Quick Assist codes via Teams from unknown tenants