From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths

T1Covered by 1 source · first reported by Microsoft Security Blog at 30 Oct, 16:11 UTC

Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths appeared first on Microsoft Security Blog.

devsecurity

Sources

• T1From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion pathsMicrosoft Security Blog30 Oct, 16:11