Cutsign — Teams help-desk impersonation to Quick Assist, then AD CS ESC1/ESC8 abuse, DCSync and exfiltration

AI-generated verdict card, published automatically by the pipeline on day one because the brief rated the story P1. Version 1, as of 2026-11-02; hype score 4 (below the usual publish bar: early read from few sources, revised as the story develops). Written by a model from the stored public sources and not reviewed by a person; re-issued in place when the evidence changes (the URL stays). The detection-coverage table below is checked automatically from public sources and re-checked daily. All cards

Teams help-desk impersonation to Quick Assist, then AD CS ESC1/ESC8 abuse, DCSync and exfiltration

Hunt + hardenP1confidence: highP1 +2deep read +1primary source +1P1: card on day one (score below the publish bar; revised as the story develops)

Microsoft reports two unattributed intrusions that went from a Teams 'IT support' chat and a Quick Assist session to domain-level credentials through misconfigured AD CS. There is no patch. Today, hunt for external Teams contact followed by Quick Assist, and audit AD CS templates (ESC1) and Web Enrollment EPA/NTLM settings (ESC8).

Triage: The vector uses ubiquitous Teams and AD CS. It led to confirmed DCSync and data exfiltration in at least one case, and there is no patch, only configuration [S1].

The core claims come from Microsoft's own incident write-up [S1]. The Hacker News [S2] repeats it as secondary reporting. Both describe two cases, with no attribution and no stated victim count.

What happened

In two unattributed intrusions, attackers posed as IT support on Teams from external onmicrosoft.com tenants and persuaded users to start Quick Assist and share the connection code [S1][S2].
They staged archives into KB-prefixed folders under the user profile and ran payloads with portable or renamed Python, Bun or Java runtimes, followed by discovery of OS version, network configuration and processes [S1][S2].
Case 1: they abused an ESC1 template to get certificates for three highly privileged accounts and ran DCSync within seconds. They then exfiltrated file-share data with Rclone renamed to SearchApp.exe, sending it to an external SFTP server through a privileged account that was excluded from automatic disruption [S1][S2].
Case 2: they used PetitPotam to coerce domain-controller NTLM authentication and relayed it to AD CS Web Enrollment (ESC8). This got them a DC certificate, which they used to obtain a TGT via PKINIT before the workstation was isolated [S1][S2].
No software vulnerability is involved. Exposure depends on Teams external access, user behaviour and AD CS configuration [S1].

Timeline

2026-10-30	Microsoft publishes its investigation of the ESC1 and ESC8 intrusion paths, with hunting guidance. S1
2026-11-02	Secondary reporting by The Hacker News. S2

Detect

external_teams_chat_impersonation · m365_ual · proposer hunt, stated

index=<m365_ual> Application="Microsoft Teams" ((ActionType="ChatCreated" AND IsExternalUser=true) OR ActionType IN ("TeamsImpersonationDetected","SecurityRiskInCallDetected")) | table _time Application ActionType IsExternalUser

FROM <m365_ual> | WHERE Application == "Microsoft Teams" AND ((ActionType == "ChatCreated" AND IsExternalUser == true) OR ActionType IN ("TeamsImpersonationDetected","SecurityRiskInCallDetected")) | KEEP @timestamp, Application, ActionType, IsExternalUser

A hit means: A user received an externally initiated Teams chat, or Teams flagged impersonation or security risk in a call. This matches the entry vector in [S1]. It is high-signal only when the same user's device starts Quick Assist shortly afterwards. · Noise: Legitimate external collaboration generates external ChatCreated events; prioritize impersonation/security-risk signals and correlate with Quick Assist starts on the recipient's device to cut benign external chat volume.

Verify

Correlate the Teams event with a QuickAssist.exe start on the recipient's device. Then look for archive extraction into a KB*-named folder under the user profile and a Python, Bun or Java process running from it [S1][S2].
For runtime hits, compare the original filename and version metadata with the on-disk name. Renamed binaries such as SearchApp.exe running rclone-style recursive copy arguments are malicious [S1][S2].
For ESC1, check whether the requester identity differs from the certificate subject or SAN, which template was used, and the first authentication with the issued certificate (CA events 4886/4887) [S3].
For ESC8, check for a /certsrv request authenticated as a DC machine account coming from a non-DC host, followed by issuance and then PKINIT from a workstation [S1].
Benign look-alikes: legitimate external collaboration chats, help-desk staff using Quick Assist, the real SearchApp.exe (Windows Search) in its system path, and legitimate enrollment by authorised template users.

Scope

Affected

Active Directory Certificate Services with ESC1-vulnerable authentication templates [S1][S3]
AD CS Web Enrollment or Certificate Enrollment Web Service accepting NTLM without EPA (ESC8) [S1]
Microsoft Teams tenants allowing external access; this is social engineering, not a Teams flaw [S1]

Only if

Users accept external Teams contact and grant Quick Assist or remote-support sessions [S1]
A certificate template allows a requester-supplied subject or SAN with broad enrollment rights (ESC1) [S1][S3]
The Web Enrollment endpoint is reachable over NTLM without HTTPS+EPA (ESC8) [S1]

Not affected if

AD CS Web Enrollment is removed, or HTTPS+EPA is enforced or NTLM disabled per KB5005413
No template allows a requester-supplied subject with broad enrollment rights

Enumerate

All CAs and certificate templates: enrollee-supplies-subject flag, enrollment permissions, and client-authentication EKUs [S3]
Web Enrollment and CES endpoints: HTTPS, EPA and NTLM status [S1]
Teams external access and federation settings, and which users can receive external chats
Hosts where Quick Assist is present or used, and the approved remote-support tooling
Privileged accounts excluded from automatic attack disruption [S1]
Certificates issued in the look-back window to privileged accounts or DC machine accounts [S1]

Contain

Isolate any workstation that had a suspicious Quick Assist session. Capture memory and triage data first [S1].
Disable or restrict Teams external access, or limit it to allow-listed domains.
Block or remove Quick Assist where it is not the sanctioned remote-support tool.
Disable vulnerable templates, and disable Web Enrollment or enforce HTTPS+EPA [S1].
Revoke certificates issued through abuse and publish the CRL. Revocation cannot be undone, and certificates already used for PKINIT may have yielded TGTs that are still valid.
Review automatic-disruption exclusions on privileged accounts [S1].

Eradicate

Remove KB*-named staging folders and portable runtimes from user profiles [S1].
Remove renamed rclone (SearchApp.exe outside its system path) and any rclone configuration files [S1].
Fix the ESC1 template settings and the ESC8 EPA/NTLM settings, which are the root cause [S1][S3].
After DCSync, treat all domain credentials as exposed: reset KRBTGT twice and reset privileged account credentials [S1].

Recover

Before restoring, confirm that no templates flag as ESC1 and that Web Enrollment enforces EPA or is removed [S3].
Monitor CA 4886/4887 events for SAN mismatches, DC 4768 events with certificate data from non-DC hosts, and 4662 replication events from non-DC accounts.
Monitor for outbound SFTP from file servers and for recurrence of the hashes on the pipeline's IoC list.

Re-enter the loop when

Microsoft updates [S1] with new IoCs, attribution or additional cases.
An ESC1 or ESC8 path is found that the sources do not describe, such as CES or another relay target.
A hit appears on hosts beyond the initial user's device, or certificates issued for additional accounts are found.
Other runtimes or exfiltration tools are reported for this cluster.

Debrief

Record the Teams contact time, the Quick Assist session, the time of first certificate issuance, and the containment time.
Record which AD CS misconfiguration was present and when it was introduced.
Gaps: no attribution, no victim count or sector, the KB-folder runtime query is truncated in the source, and the provenance of the IoC hashes is not stated.
The proposed hunt query uses an index placeholder rather than index=*. The reviewer should normalise it before publishing.

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	published — primary source among the thread's sources: https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	nothing found — no post names it among the feed's 10 newest items
EDR / endpoint VM	Microsoft Security blog	published — FORGE Lab uses agentic tools to identify memory safety issues in Rust · ARTEX abuse expands as cybercriminals target financial sector · Threat actors use agentic AI tooling to find and abuse exposed secrets (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne blog	published — The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026) · Stopping Node2Shell: How SentinelOne Protects Customers From Brotli-Based Remote Code Execution · Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne Labs	nothing found — no post names it among the feed's 10 newest items
WAF / edge	Akamai blog	nothing found — no post names it among the feed's 1183 newest items
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 139 newest items
Cloud / container	Wiz blog	published — From Reactive to Proactive: Empowering SOC Teams with the Wiz Red and Blue Agents · Supply Chain Zero Days: Closing the Gap Between Publication and Detection · Securing the Mission at Machine Speed: Wiz AI Agents Arrive in Wiz for Gov (names the campaign in the title; the feed text carries no CVE id)
IDS / research	Cisco Talos blog	published — A quiet week in infosec <.< · IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases · I had plans for that second (names the campaign in the title; the feed text carries no CVE id)
Detection content	Elastic detection rules	published — 29 files name Teams / Quick / Assist: rules/integrations/o365/persistence_teams_guest_access_enabled.toml, rules/integrations/o365/initial_access_teams_rogue_helpdesk_chat.toml, rules/integrations/o365/defense_evasion_teams_external_access_enabled.toml, rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed.toml
Detection content	Elastic Security Labs	published — When trust becomes the payload: Inside the threats, etc quarterly report · php2shell: Assessing Elastic detection coverage relevant to CVE-2026-109618 and CVE-2026-109619 · Introducing AlertZero: Inbox zero for your alert queue (names the campaign in the title; the feed text carries no CVE id)
Detection content	SigmaHQ rules	published — 32 files name Teams / Quick / Assist: deprecated/windows/file_event_win_access_susp_teams.yml, rules/windows/file/file_access/file_access_win_teams_sensitive_files.yml, rules/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml, rules/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml
Detection content	Splunk ESCU	published — 23 files name Teams / Quick / Assist: README.md, detections/endpoint/windows_impair_defense_change_win_defender_quick_scan_interval.yml, docs/ci/yaml_formatting.md, detections/cloud/microsoft_intune_mobile_apps.yml
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	published — 10 Endpoint Security Trends and Tips for 2027 \| Huntress (names the campaign in the title; the feed text carries no CVE id)
MSSP / IR firms	Rapid7 blog	published — Gartner Report: The Attack Path is Closing Faster than Most Teams Can Patch · Rapid7 Achieves ISO/IEC 42001 Certification for its AI Management System · The Race Against the 3-Day Clock: How Rapid7 Helps Meet BOD 26-04 Compliance (names the campaign in the title; the feed text carries no CVE id)
MSSP / IR firms	Sophos threat research	nothing found — no post names it among the feed's 15 newest items
Research	Unit 42	nothing found — no post names it among the feed's 15 newest items

Checked automatically 2026-11-10 04:09Z from public sources: 11 published, 7 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (5)

EDR	Does it flag renamed binaries (original filename differs from on-disk name) and interpreters launched from user-writable paths after a remote-support session?
Identity threat detection	Does it alert on ESC1 template abuse, ESC8 machine-certificate issuance, NTLM relay, PKINIT anomalies and DCSync?
SIEM / CA logging	Are Certification Services audit and the CA audit filter enabled, and are IIS logs from Web Enrollment servers ingested?
Email/collaboration security	Are Teams external-chat and impersonation signals ingested and alerted on?
Network / proxy	Are outbound SFTP connections from servers logged and restricted?

Exposure queries — generated automatically

shodan · alias · card

http.title:"Microsoft Active Directory Certificate Services"

open · Banner spelling suggested by the model from the card text (AD CS web enrollment page heading shown to browsers); counted against Shodan before it was shown.

4services internet-wide on Shodan · 2026-11-10▬ 4 on 2026-11-02 (+0 +0%) · 4 on 2026-11-09 (+0 +0%)

shodan · alias · card

http.html:"Microsoft Active Directory Certificate Services"

open · Banner spelling suggested by the model from the card text (AD CS Web Enrollment pages carry this text in their body); counted against Shodan before it was shown.

6services internet-wide on Shodan · 2026-11-10▼ 8 on 2026-11-02 (-2 -25%) · 6 on 2026-11-09 (+0 +0%)

Internet-wide count, trend

Query	First	Latest	Change
`http.html:"Microsoft Active Directory Certificate Services"`	8 2026-11-02	6 2026-11-10	-2 (-25%) over 9 days
`http.title:"Microsoft Active Directory Certificate Services"`	4 2026-11-02	4 2026-11-10	+0 (+0%) over 9 days

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 04:09Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

Which source the three SHA-256 hashes come from, and which artefacts they correspond to.
Whether the two cases are linked to a known actor or are separate operators.
The full text of the truncated KB-folder runtime query in [S1].
Whether the Windows Server 2025 default-EPA claim and the 2019/2022 manual-EPA note are stated in [S1] or come from other Microsoft guidance; this needs a source citation.

Sources

[S1] https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ · Microsoft Security Blog
[S2] https://thehackernews.com/2026/11/attackers-pose-as-it-support-on.html · The Hacker News
[S3] https://learn.microsoft.com/defender-for-identity/security-posture-assessments/certificates · Microsoft Learn

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.