ESC1 and ESC8 Attack Paths: From Social Engineering to AD CS Abuse

Summary

Threat actors used social engineering through Microsoft Teams to impersonate IT help desk staff and establish remote access with Quick Assist. After gaining access, they abused misconfigured Active Directory Certificate Services (AD CS) through ESC1 and ESC8 techniques to escalate privileges and obtain domain-level authentication. The intrusions enabled unauthorized certificate enrollment, DCSync activity, and subsequent data exfiltration.

Investigation

The investigation reconstructed the attack chain from the initial Teams phishing interaction through later certificate abuse. Analysts correlated remote session telemetry, suspicious runtime execution from user-writable directories, and AD CS events, including certificate enrollment requests and PKINIT activity. Mismatches between authenticated identities and originating devices provided important pivots for identifying potential NTLM relay attacks.

Mitigation

Organizations should enforce strong verification procedures for unsolicited support requests and restrict external access in Microsoft Teams. Technical mitigations include using App Control for Business to block unauthorized runtimes and hardening AD CS by enabling Extended Protection for Authentication (EPA) and HTTPS on enrollment endpoints. Disabling NTLM on enrollment services and regularly auditing certificate templates are also critical.

Response

When malicious activity is detected, responders should immediately isolate affected workstations and review compromised identities for exclusion risks. Unauthorized certificates must be revoked and updated revocation information published. Active Kerberos tickets should be assessed separately, since certificate revocation does not invalidate existing TGTs. Manual containment should also be assigned to accounts excluded from automated disruption.

Simulation Execution

• Attack Narrative & Commands: The adversary initiates a phishing campaign via Microsoft Teams, impersonating IT support. They instruct the victim to open “Quick Assist.” Once the session is established, the attacker uses the remote access to drop a portable python.exe into a disguised directory: C:Users<User>AppDataRoamingKB. Finally, to facilitate lateral movement, the attacker executes systeminfo and ipconfig to gather reconnaissance data on the host.

• Regression Test Script:

  # Simulation Script: Teams Phishing & Portable Runtime Execution
  
  # 1. Setup: Create the 'malicious' directory in AppData
  $targetDir = "$env:APPDATAKB"
  if (!(Test-Path $targetDir)) { New-Item -Path $targetDir -ItemType Directory -Force }
  
  # 2. Simulate the portable runtime (creating a dummy file named python.exe)
  # In a real attack, this would be a real binary.
  $dummyPython = Join-Path $targetDir "python.exe"
  New-Item -Path $dummyPython -ItemType File -Force
  
  # 3. Simulate the 'Teams' parent process spawning Quick Assist
  # Note: Since we cannot easily spoof the actual Teams.exe process tree in a single script 
  # without advanced injection, we simulate the telemetry by mimicking the command line 
  # and expected behavior in a way that mimics the logic.
  
  Write-Host "[!] Simulating Attack Sequence..."
  
  # Trigger the detection logic by simulating the process chain
  # Note: To trigger the specific Sigma rule, the process 'python.exe' 
  # must be seen as a child of 'Teams.exe' in the telemetry stream.
  
  # Step A: Simulate Teams calling Quick Assist (Manual simulation of telemetry)
  # In a real test environment, you might use a tool like 'ProcessHacker' or 'Sysmon'
  # to manipulate parent PIDs, but for this script, we will execute the sequence.
  
  Start-Process "cmd.exe" -ArgumentList "/c echo Simulating Teams calling Quick Assist"
  
  # Step B: Execute the 'portable runtime' from the specific path
  Start-Process -FilePath $dummyPython -ArgumentList "--version" -ErrorAction SilentlyContinue
  
  # Step C: Execute Discovery Commands
  Start-Process "cmd.exe" -ArgumentList "/c systeminfo"
  Start-Process "cmd.exe" -ArgumentList "/c ipconfig"
  Start-Process "cmd.exe" -ArgumentList "/c tasklist"
  
  Write-Host "[+] Simulation complete. Check SIEM for alerts."

• Cleanup Commands:

  # Cleanup: Remove the simulated malicious directory and files
  $targetDir = "$env:APPDATAKB"
  if (Test-Path $targetDir) {
      Remove-Item -Path $targetDir -Recurse -Force
      Write-Host "[+] Cleanup successful: $targetDir removed."
  } else {
      Write-Host "[-] Cleanup failed: Directory not found."
  }