Help Desk Impersonation and AD CS Abuse Reveal ESC1 & ESC8 Intrusion Paths
What Happened — Microsoft Security Research published a detailed analysis of two newly‑documented intrusion pathways that adversaries are using to move laterally and persist inside Active Directory (AD) environments.
- ESC1 – Help‑desk impersonation – Attackers first obtain credentials for a help‑desk account through phishing or credential‑stuffing. They then leverage the help‑desk’s privileged password‑reset capability to request resets for high‑value accounts (e.g., domain admins) without proper verification.
- ESC8 – AD Certificate Services (AD CS) abuse – After gaining a privileged foothold, the threat actors request or forge certificates from AD CS, allowing them to sign Kerberos tickets (Golden Ticket style) or establish TLS‑based tunnels for stealthy lateral movement.
The researchers observed these techniques in multiple APT‑style campaigns targeting large enterprises across several sectors. The abuse of AD CS is especially concerning because the service is often left unchecked, providing a “golden key” once a rogue certificate is issued. Microsoft recommends tightening help‑desk workflows, enforcing MFA for privileged service accounts, and enabling comprehensive logging of AD CS activity.
Why It Matters for Trust & Control Assurance – The attack chain tests the control objective of identity and access management verification – ensuring that privileged account actions are properly vetted and that certificate issuance is continuously monitored.
Who Is Affected – Any organization that runs Microsoft Active Directory and AD Certificate Services, spanning finance, health, manufacturing, government, and cloud‑focused enterprises.
Recommended Actions
- Enforce multi‑factor authentication (MFA) on all help‑desk and privileged service accounts.
- Institute a documented, multi‑step verification process for any password‑reset or privileged‑access request.
- Enable detailed logging of AD CS certificate requests and configure real‑time alerts for anomalous issuance.
- Conduct regular privileged‑access reviews and phishing simulations targeting help‑desk staff.
- Deploy continuous monitoring solutions that surface evidence of these controls for audit readiness.
Technical Notes – Attack vectors: stolen credentials (phishing, credential‑stuffing) and abuse of a legitimate AD service (AD CS). No specific CVE is involved; the risk stems from procedural gaps and mis‑configured trust relationships. Source: Microsoft Security Blog